diff --git a/.github/workflows/badges.yaml b/.github/workflows/badges.yaml
index 63ee736dca..7b787f77af 100644
--- a/.github/workflows/badges.yaml
+++ b/.github/workflows/badges.yaml
@@ -6,8 +6,7 @@ on:
 
 env:
   BASE_IMAGE: openpilot-base
-  DOCKER_REGISTRY: ghcr.io/commaai
-  RUN: docker run --shm-size 2G -v $PWD:/tmp/openpilot -w /tmp/openpilot -e PYTHONPATH=/tmp/openpilot -e NUM_JOBS -e JOB_ID -e GITHUB_ACTION -e GITHUB_REF -e GITHUB_HEAD_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_RUN_ID -v $GITHUB_WORKSPACE/.ci_cache/scons_cache:/tmp/scons_cache -v $GITHUB_WORKSPACE/.ci_cache/comma_download_cache:/tmp/comma_download_cache -v $GITHUB_WORKSPACE/.ci_cache/openpilot_cache:/tmp/openpilot_cache $DOCKER_REGISTRY/$BASE_IMAGE:latest /bin/bash -c
+  RUN: export UV_BIN="/home/runner/.local/bin" ; export PATH="$UV_BIN:$PATH" ; source /home/runner/.venv/bin/activate || true ; export PYTHONPATH=/tmp/openpilot ; export CI=1 ; export PYTHONWARNINGS=error ; export FILEREADER_CACHE=1 ; bash -c
 
 jobs:
   badges:
diff --git a/.github/workflows/prebuilt.yaml b/.github/workflows/prebuilt.yaml
index d8963ec89f..f4a5967253 100644
--- a/.github/workflows/prebuilt.yaml
+++ b/.github/workflows/prebuilt.yaml
@@ -5,8 +5,7 @@ on:
   workflow_dispatch:
 
 env:
-  DOCKER_LOGIN: docker login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
-  BUILD: selfdrive/test/docker_build.sh prebuilt
+  BUILD: selfdrive/test/build.sh prebuilt
 
 jobs:
   build_prebuilt:
@@ -33,7 +32,6 @@ jobs:
       with:
         submodules: true
     - run: git lfs pull
-    - name: Build and Push docker image
+    - name: Build and Push rootfs image
       run: |
-        $DOCKER_LOGIN
         eval "$BUILD"
diff --git a/.github/workflows/repo-maintenance.yaml b/.github/workflows/repo-maintenance.yaml
index 7bb91c0ca4..8a9f8215ae 100644
--- a/.github/workflows/repo-maintenance.yaml
+++ b/.github/workflows/repo-maintenance.yaml
@@ -7,8 +7,8 @@ on:
 
 env:
   BASE_IMAGE: openpilot-base
-  BUILD: selfdrive/test/docker_build.sh base
-  RUN: docker run --shm-size 2G -v $PWD:/tmp/openpilot -w /tmp/openpilot -e CI=1 -e PYTHONWARNINGS=error -e FILEREADER_CACHE=1 -e PYTHONPATH=/tmp/openpilot -e NUM_JOBS -e JOB_ID -e GITHUB_ACTION -e GITHUB_REF -e GITHUB_HEAD_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_RUN_ID -v $GITHUB_WORKSPACE/.ci_cache/scons_cache:/tmp/scons_cache -v $GITHUB_WORKSPACE/.ci_cache/comma_download_cache:/tmp/comma_download_cache -v $GITHUB_WORKSPACE/.ci_cache/openpilot_cache:/tmp/openpilot_cache $BASE_IMAGE /bin/bash -c
+  BUILD: selfdrive/test/build.sh base
+  RUN: export UV_BIN="/home/runner/.local/bin" ; export PATH="$UV_BIN:$PATH" ; source /home/runner/.venv/bin/activate || true ; export PYTHONPATH=/tmp/openpilot ; export CI=1 ; export PYTHONWARNINGS=error ; export FILEREADER_CACHE=1 ; bash -c
 
 jobs:
   update_translations:
diff --git a/.github/workflows/selfdrive_tests.yaml b/.github/workflows/selfdrive_tests.yaml
index aad772757d..44ff010862 100644
--- a/.github/workflows/selfdrive_tests.yaml
+++ b/.github/workflows/selfdrive_tests.yaml
@@ -22,10 +22,9 @@ env:
   BASE_IMAGE: openpilot-base
   AZURE_TOKEN: ${{ secrets.AZURE_COMMADATACI_OPENPILOTCI_TOKEN }}
 
-  DOCKER_LOGIN: docker login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
-  BUILD: selfdrive/test/docker_build.sh base
+  BUILD: selfdrive/test/build.sh base
 
-  RUN: docker run --shm-size 2G -v $PWD:/tmp/openpilot -w /tmp/openpilot -e CI=1 -e PYTHONWARNINGS=error -e FILEREADER_CACHE=1 -e PYTHONPATH=/tmp/openpilot -e NUM_JOBS -e JOB_ID -e GITHUB_ACTION -e GITHUB_REF -e GITHUB_HEAD_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_RUN_ID -v $GITHUB_WORKSPACE/.ci_cache/scons_cache:/tmp/scons_cache -v $GITHUB_WORKSPACE/.ci_cache/comma_download_cache:/tmp/comma_download_cache -v $GITHUB_WORKSPACE/.ci_cache/openpilot_cache:/tmp/openpilot_cache $BASE_IMAGE /bin/bash -c
+  RUN: export UV_BIN="/home/runner/.local/bin" ; export PATH="$UV_BIN:$PATH" ; source /home/runner/.venv/bin/activate || true ; export PYTHONPATH=/tmp/openpilot ; export CI=1 ; export PYTHONWARNINGS=error ; export FILEREADER_CACHE=1 ; bash -c
 
   PYTEST: pytest --continue-on-collection-errors --durations=0 -n logical
 
diff --git a/.github/workflows/setup/action.yaml b/.github/workflows/setup/action.yaml
index 818060c3b0..a21616dab1 100644
--- a/.github/workflows/setup/action.yaml
+++ b/.github/workflows/setup/action.yaml
@@ -30,12 +30,12 @@ runs:
     - shell: bash
       run: git lfs pull
 
-    # build cache
+    # build scons cache
     - id: date
       shell: bash
-      run: echo "CACHE_COMMIT_DATE=$(git log -1 --pretty='format:%cd' --date=format:'%Y-%m-%d-%H:%M')" >> $GITHUB_ENV
+      run: echo "CACHE_COMMIT_DATE=$(git log -1 --pretty='format:%cd' --date=format:'%Y-%m-%d-%H:%M')" >> $GITHUB_ENV ; echo "CACHE_FILE_HASHES=$(sha256sum selfdrive/test/build.sh tools/install_ubuntu_dependencies.sh tools/install_python_dependencies.sh | cut -d" " -f1 | tr '\n' '_')" >> $GITHUB_ENV
     - shell: bash
-      run: echo "$CACHE_COMMIT_DATE"
+      run: echo "$CACHE_COMMIT_DATE" ; echo "$CACHE_FILE_HASHES"
     - id: scons-cache
       uses: ./.github/workflows/auto-cache
       with:
@@ -44,13 +44,20 @@ runs:
         restore-keys: |
           scons-${{ runner.arch }}-${{ env.CACHE_COMMIT_DATE }}
           scons-${{ runner.arch }}
-    # as suggested here: https://github.com/moby/moby/issues/32816#issuecomment-910030001
-    - id: normalize-file-permissions
-      shell: bash
-      name: Normalize file permissions to ensure a consistent docker build cache
-      run: |
-        find . -type f -executable -not -perm 755 -exec chmod 755 {} \;
-        find . -type f -not -executable -not -perm 644 -exec chmod 644 {} \;
-    # build our docker image
+
+    # try to restore rootfs image cache
+    - id: rootfs-cache
+      uses: actions/cache/restore@v4
+      with:
+        path: /tmp/rootfs_cache.tar
+        key: rootfs-${{ runner.arch }}-${{ env.CACHE_FILE_HASHES }}
+    # build our rootfs image
     - shell: bash
       run: eval ${{ env.BUILD }}
+    # try to save rootfs image cache
+    - name: Save rootfs cache
+      uses: actions/cache/save@v4
+      #if: github.ref == 'refs/heads/master'
+      with:
+        path: /tmp/rootfs_cache.tar
+        key: rootfs-${{ runner.arch }}-${{ env.CACHE_FILE_HASHES }}
diff --git a/Dockerfile.openpilot b/Dockerfile.openpilot
deleted file mode 100644
index d85be77121..0000000000
--- a/Dockerfile.openpilot
+++ /dev/null
@@ -1,12 +0,0 @@
-FROM ghcr.io/commaai/openpilot-base:latest
-
-ENV PYTHONUNBUFFERED=1
-
-ENV OPENPILOT_PATH=/home/batman/openpilot
-
-RUN mkdir -p ${OPENPILOT_PATH}
-WORKDIR ${OPENPILOT_PATH}
-
-COPY . ${OPENPILOT_PATH}/
-
-RUN scons --cache-readonly -j$(nproc)
diff --git a/Dockerfile.openpilot_base b/Dockerfile.openpilot_base
deleted file mode 100644
index 44d8d95e95..0000000000
--- a/Dockerfile.openpilot_base
+++ /dev/null
@@ -1,81 +0,0 @@
-FROM ubuntu:24.04
-
-ENV PYTHONUNBUFFERED=1
-
-ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends sudo tzdata locales ssh pulseaudio xvfb x11-xserver-utils gnome-screenshot python3-tk python3-dev && \
-    rm -rf /var/lib/apt/lists/*
-
-RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && locale-gen
-ENV LANG=en_US.UTF-8
-ENV LANGUAGE=en_US:en
-ENV LC_ALL=en_US.UTF-8
-
-COPY tools/install_ubuntu_dependencies.sh /tmp/tools/
-RUN /tmp/tools/install_ubuntu_dependencies.sh && \
-    rm -rf /var/lib/apt/lists/* /tmp/* && \
-    cd /usr/lib/gcc/arm-none-eabi/* && \
-    rm -rf arm/ thumb/nofp thumb/v6* thumb/v8* thumb/v7+fp thumb/v7-r+fp.sp
-
-# Add OpenCL
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    apt-utils \
-    alien \
-    unzip \
-    tar \
-    curl \
-    xz-utils \
-    dbus \
-    gcc-arm-none-eabi \
-    tmux \
-    vim \
-    libx11-6 \
-    wget \
-  && rm -rf /var/lib/apt/lists/*
-
-RUN mkdir -p /tmp/opencl-driver-intel && \
-    cd /tmp/opencl-driver-intel && \
-    wget https://github.com/intel/llvm/releases/download/2024-WW14/oclcpuexp-2024.17.3.0.09_rel.tar.gz && \
-    wget https://github.com/oneapi-src/oneTBB/releases/download/v2021.12.0/oneapi-tbb-2021.12.0-lin.tgz && \
-    mkdir -p /opt/intel/oclcpuexp_2024.17.3.0.09_rel && \
-    cd /opt/intel/oclcpuexp_2024.17.3.0.09_rel && \
-    tar -zxvf /tmp/opencl-driver-intel/oclcpuexp-2024.17.3.0.09_rel.tar.gz && \
-    mkdir -p /etc/OpenCL/vendors && \
-    echo /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64/libintelocl.so > /etc/OpenCL/vendors/intel_expcpu.icd && \
-    cd /opt/intel && \
-    tar -zxvf /tmp/opencl-driver-intel/oneapi-tbb-2021.12.0-lin.tgz && \
-    ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbb.so /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64 && \
-    ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbbmalloc.so /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64 && \
-    ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbb.so.12 /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64 && \
-    ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbbmalloc.so.2 /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64 && \
-    mkdir -p /etc/ld.so.conf.d && \
-    echo /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64 > /etc/ld.so.conf.d/libintelopenclexp.conf && \
-    ldconfig -f /etc/ld.so.conf.d/libintelopenclexp.conf && \
-    cd / && \
-    rm -rf /tmp/opencl-driver-intel
-
-ENV NVIDIA_VISIBLE_DEVICES=all
-ENV NVIDIA_DRIVER_CAPABILITIES=graphics,utility,compute
-ENV QTWEBENGINE_DISABLE_SANDBOX=1
-
-RUN dbus-uuidgen > /etc/machine-id
-
-ARG USER=batman
-ARG USER_UID=1001
-RUN useradd -m -s /bin/bash -u $USER_UID $USER
-RUN usermod -aG sudo $USER
-RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
-USER $USER
-
-COPY --chown=$USER pyproject.toml uv.lock /home/$USER
-COPY --chown=$USER tools/install_python_dependencies.sh /home/$USER/tools/
-
-ENV VIRTUAL_ENV=/home/$USER/.venv
-ENV PATH="$VIRTUAL_ENV/bin:$PATH"
-RUN cd /home/$USER && \
-    tools/install_python_dependencies.sh && \
-    rm -rf tools/ pyproject.toml uv.lock .cache
-
-USER root
-RUN sudo git config --global --add safe.directory /tmp/openpilot
diff --git a/selfdrive/test/build.sh b/selfdrive/test/build.sh
new file mode 100755
index 0000000000..ddcde537c8
--- /dev/null
+++ b/selfdrive/test/build.sh
@@ -0,0 +1,257 @@
+#!/usr/bin/env bash
+#set -e
+trap restore_roota ERR
+ORG_PWD="$PWD"
+
+REPO="$HOME/work/openpilot/openpilot"
+CACHE_ROOTFS_TARBALL_PATH="/tmp/rootfs_cache.tar"
+
+prepare_mounts() {
+    # create and mount the required volumes where they're expected
+    mkdir -p /tmp/openpilot /tmp/scons_cache /tmp/comma_download_cache /tmp/openpilot_cache
+    sudo mount --bind "$REPO" /tmp/openpilot
+
+    sudo mount --bind "$REPO/.ci_cache/scons_cache" /tmp/scons_cache || true
+    sudo mount --bind "$REPO/.ci_cache/comma_download_cache" /tmp/comma_download_cache || true
+    sudo mount --bind "$REPO/.ci_cache/openpilot_cache" /tmp/openpilot_cache || true
+
+    # needed for the unit tests not to fail
+    sudo chmod 755 /sys/fs/pstore
+}
+
+commit_root() {
+
+    sudo mkdir -p /base /newroot /upper /work
+    
+    sudo unshare -f --kill-child -m $ORG_PWD/selfdrive/test/build_inside.sh
+    ec=$?
+    echo "end of ns"
+
+    sudo rm -rf /base /newroot /work
+
+    mkdir -p /tmp/rootfs_cache
+    sudo rm -f "$CACHE_ROOTFS_TARBALL_PATH" # remove the old tarball from previous run, if exists
+    cd /upper
+    sudo tar -cf "$CACHE_ROOTFS_TARBALL_PATH" .
+    cd
+
+    sudo rm -rf /upper
+
+    cd /
+    sudo tar -xf "$CACHE_ROOTFS_TARBALL_PATH" 2>/dev/null || true
+    cd
+
+    prepare_mounts
+
+    exit $ec
+
+
+}
+
+#declare -a mounts
+commit_root_old() {
+
+    sudo mkdir -p /upper /work /overlay # prepare directories for overlayfs
+    org_mounts="$(cat /proc/mounts)" # save the original mounts table
+
+    target="/overlay"
+    sudo mkdir -p /lower
+    sudo mount --bind / /lower
+    mounts+=("/lower")
+    sudo mount -t overlay overlay -o lowerdir=/lower,upperdir=/upper,workdir=/work "$target" # mount the overlayfs
+    mounts+=("/")
+
+    while read line # bind-mount any mounts under the old rootfs into the new one (overlayfs isn't recursive like e.g. `mount --rbind`)
+    do
+        echo DOING $line
+        if [ "$line" != "/" ] # except the rootfs base, to avoid infinite mountpoint loops
+        then
+            target="/overlay$line"
+            sudo mount --bind "$line" "$target" || true
+            mounts+=("$line")
+        fi
+    done < <(echo "$org_mounts" | cut -d" " -f2)
+
+    # remove the MS_SHARED flag from the original rootfs mount, which isn't supported by pivot_root(8) and would cause it to fail (see: https://lxc-users.linuxcontainers.narkive.com/pNQKxcnN/pivot-root-failures-when-is-mounted-as-shared)
+    sudo mount --make-rprivate /
+
+    # prepare for the pivot_root(8) and execute, swapping places of the original rootfs and the new one on overlayfs (with its lowerdir still being the original one)
+    # (what this achieves is committing the state of the original rootfs and making it read-only, while creating a new, virtual read-write rootfs with all changes written into a separate directory, the upperdir)
+    cd /overlay
+    sudo mkdir -p old
+    sudo pivot_root . old # once this finishes, the system is moved to the new rootfs and all newly open file descriptors will point to it
+    #sudo systemctl daemon-reexec
+    cd
+
+    mount
+
+    ls /home/runner
+
+    sudo touch /root_commited
+
+    exec "$ORG_PWD/$0" "$@"
+
+
+}
+
+restore_roota() {
+
+    echo failed at ${BASH_LINENO[0]}
+
+}
+
+restore_root() {
+
+    echo failed at ${BASH_LINENO[0]}
+
+    echo mounts "${mounts[@]}"
+
+    cd /old
+    sudo mkdir -p new
+    sudo pivot_root . new
+    #sudo systemctl daemon-reexec
+    cd
+
+
+    for (( i=${#mounts[@]}-1; i>=0; i-- ))
+    do
+        #sudo lsof "/new/${mounts[i]}" || true
+        sudo umount -l "/lower/overlay/${mounts[i]}" || true
+        sudo umount -l "/new/${mounts[i]}" || true
+    done
+
+    mount
+
+    rm -f /root_commited
+
+}
+
+echo AAA
+mount
+echo BBB
+
+if [ -f "$CACHE_ROOTFS_TARBALL_PATH" ]
+then
+    # if the rootfs diff tarball (also created by this script) got restored from the CI native cache, unpack it, upgrading the rootfs
+    echo "restoring rootfs from the native build cache"
+    cd /
+    sudo tar -xf "$CACHE_ROOTFS_TARBALL_PATH" 2>/dev/null || true
+    cd
+    rm "$CACHE_ROOTFS_TARBALL_PATH"
+
+    # before the next tasks are run, finalize the environment for them
+    prepare_mounts
+
+    # EXITS HERE - if the rootfs could been prepared entirely from the cache, there's no need for any further action like re-building
+    exit 0
+else
+    # otherwise, we'll have to install everything from scratch and build the tarball to be available for the next run
+    echo "no native build cache entry restored, rebuilding"
+fi
+
+# in case this script was run on the same instance before, umount any overlays which were mounted by the previous runs
+#tac /proc/mounts | grep overlay | grep -v "overlay / " | cut -d" " -f2 | while read line; do sudo umount "$line" || true; done
+
+# in order to be able to build a diff rootfs tarball, we need to commit its initial state by moving it on-the-fly to overlayfs;
+# below, we prepare the system and the new rootfs itself
+
+
+if ! [ -e /root_committed ]
+then
+commit_root
+fi
+
+
+
+# -------- at this point, the original rootfs was committed and all the changes to it done below will be saved to the newly created rootfs diff tarball --------
+
+# install and set up the native dependencies needed
+PYTHONUNBUFFERED=1
+DEBIAN_FRONTEND=noninteractive
+
+mkdir -p /tmp/tools
+cp "$REPO/tools/install_ubuntu_dependencies.sh" /tmp/tools/
+sudo /tmp/tools/install_ubuntu_dependencies.sh &>/dev/null
+
+sudo apt-get install -y --no-install-recommends \
+    sudo tzdata locales ssh pulseaudio xvfb x11-xserver-utils gnome-screenshot python3-tk python3-dev \
+    apt-utils alien unzip tar curl xz-utils dbus gcc-arm-none-eabi tmux vim libx11-6 wget &>/dev/null
+
+sudo rm -rf /var/lib/apt/lists/*
+sudo apt-get clean
+
+cd /usr/lib/gcc/arm-none-eabi/*
+sudo rm -rf arm/ thumb/nofp thumb/v6* thumb/v8* thumb/v7+fp thumb/v7-r+fp.sp
+cd
+
+sudo sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
+sudo locale-gen
+LANG=en_US.UTF-8
+LANGUAGE=en_US:en
+LC_ALL=en_US.UTF-8
+
+mkdir -p /tmp/opencl-driver-intel
+cd /tmp/opencl-driver-intel
+wget https://github.com/intel/llvm/releases/download/2024-WW14/oclcpuexp-2024.17.3.0.09_rel.tar.gz &>/dev/null
+wget https://github.com/oneapi-src/oneTBB/releases/download/v2021.12.0/oneapi-tbb-2021.12.0-lin.tgz &>/dev/null
+sudo mkdir -p /opt/intel/oclcpuexp_2024.17.3.0.09_rel
+cd /opt/intel/oclcpuexp_2024.17.3.0.09_rel
+sudo tar -zxvf /tmp/opencl-driver-intel/oclcpuexp-2024.17.3.0.09_rel.tar.gz
+sudo mkdir -p /etc/OpenCL/vendors
+sudo bash -c "echo /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64/libintelocl.so > /etc/OpenCL/vendors/intel_expcpu.icd"
+cd /opt/intel
+sudo tar -zxvf /tmp/opencl-driver-intel/oneapi-tbb-2021.12.0-lin.tgz
+sudo ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbb.so /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64
+sudo ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbbmalloc.so /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64
+sudo ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbb.so.12 /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64
+sudo ln -s /opt/intel/oneapi-tbb-2021.12.0/lib/intel64/gcc4.8/libtbbmalloc.so.2 /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64
+sudo mkdir -p /etc/ld.so.conf.d
+sudo bash -c "echo /opt/intel/oclcpuexp_2024.17.3.0.09_rel/x64 > /etc/ld.so.conf.d/libintelopenclexp.conf"
+sudo ldconfig -f /etc/ld.so.conf.d/libintelopenclexp.conf
+cd /
+rm -rf /tmp/opencl-driver-intel
+cd
+
+sudo bash -c "dbus-uuidgen > /etc/machine-id"
+
+NVIDIA_VISIBLE_DEVICES=all
+NVIDIA_DRIVER_CAPABILITIES=graphics,utility,compute
+QTWEBENGINE_DISABLE_SANDBOX=1
+
+# install and set up the Python dependencies needed
+
+#sudo useradd -m -s /bin/bash -u 1002 test
+sudo cp "/home/runner/work/openpilot/openpilot/pyproject.toml" "/home/runner/work/openpilot/openpilot/uv.lock" "/home/runner/work/openpilot/openpilot/tools/install_python_dependencies.sh" \
+    /home/runner/
+#sudo chown -R test:test /home/test
+
+cd
+#chown -R runner:run
+
+rm -rf .venv
+
+mkdir aaa
+cd aaa
+../install_python_dependencies.sh
+cd
+
+
+#sudo -u test bash -c " export HOME=/home/test ; export XDG_CONFIG_HOME=/home/test/.config ; cd /home/test ; ./install_python_dependencies.sh"
+#sudo chown -R runner:runner /home/test
+
+#cd /home/test ; rm pyproject.toml uv.lock install_python_dependencies.sh ; ls -la ; cd
+rm pyproject.toml uv.lock install_python_dependencies.sh
+
+#sudo rsync -aL /home/test/.venv/ /home/runner/.venv/
+#sudo rsync -aL /home/test/.local/ /home/runner/.local/
+#sudo rm -rf /home/test
+
+
+# add a git safe directory for compiling openpilot
+sudo git config --global --add safe.directory /tmp/openpilot
+
+# finally, create the rootfs diff tarball (to be pushed into the CI native cache)
+
+
+# before the next tasks are run, finalize the environment for them
+#prepare_mounts
diff --git a/selfdrive/test/build_inside.sh b/selfdrive/test/build_inside.sh
new file mode 100755
index 0000000000..2436e1eee6
--- /dev/null
+++ b/selfdrive/test/build_inside.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+sudo mount --bind / /base
+mount -t overlay overlay -o lowerdir=/base,upperdir=/upper,workdir=/work /newroot
+rm -f /newroot/etc/resolv.conf
+touch /newroot/etc/resolv.conf
+cat /etc/resolv.conf > /newroot/etc/resolv.conf
+
+
+
+mkdir -p /newroot/old
+cd /newroot
+pivot_root . old
+
+mount -t proc proc /proc
+mount -t devtmpfs devtmpfs /dev
+mkdir -p /dev/pts
+mount -t devpts devpts /dev/pts
+mount -t proc proc /proc
+mount -t sysfs sysfs /sys
+
+
+
+mount
+
+touch /root_committed
+sudo -u runner /home/runner/work/openpilot/openpilot/selfdrive/test/build.sh
+ec=$?
+
+echo "hello"
+
+#sudo umount /newroot
+#sudo umount /base
+
+exit $ec
diff --git a/selfdrive/test/docker_build.sh b/selfdrive/test/docker_build.sh
deleted file mode 100755
index 4d58a1507c..0000000000
--- a/selfdrive/test/docker_build.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-# To build sim and docs, you can run the following to mount the scons cache to the same place as in CI:
-# mkdir -p .ci_cache/scons_cache
-# sudo mount --bind /tmp/scons_cache/ .ci_cache/scons_cache
-
-SCRIPT_DIR=$(dirname "$0")
-OPENPILOT_DIR=$SCRIPT_DIR/../../
-if [ -n "$TARGET_ARCHITECTURE" ]; then
-  PLATFORM="linux/$TARGET_ARCHITECTURE"
-  TAG_SUFFIX="-$TARGET_ARCHITECTURE"
-else
-  PLATFORM="linux/$(uname -m)"
-  TAG_SUFFIX=""
-fi
-
-source $SCRIPT_DIR/docker_common.sh $1 "$TAG_SUFFIX"
-
-DOCKER_BUILDKIT=1 docker buildx build --provenance false --pull --platform $PLATFORM --load --cache-to type=inline --cache-from type=registry,ref=$REMOTE_TAG -t $DOCKER_IMAGE:latest -t $REMOTE_TAG -t $LOCAL_TAG -f $OPENPILOT_DIR/$DOCKER_FILE $OPENPILOT_DIR
-
-if [ -n "$PUSH_IMAGE" ]; then
-  docker push $REMOTE_TAG
-  docker tag $REMOTE_TAG $REMOTE_SHA_TAG
-  docker push $REMOTE_SHA_TAG
-fi
diff --git a/selfdrive/test/docker_common.sh b/selfdrive/test/docker_common.sh
deleted file mode 100644
index 2887fff74b..0000000000
--- a/selfdrive/test/docker_common.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-if [ "$1" = "base" ]; then
-  export DOCKER_IMAGE=openpilot-base
-  export DOCKER_FILE=Dockerfile.openpilot_base
-elif [ "$1" = "prebuilt" ]; then
-  export DOCKER_IMAGE=openpilot-prebuilt
-  export DOCKER_FILE=Dockerfile.openpilot
-else
-  echo "Invalid docker build image: '$1'"
-  exit 1
-fi
-
-export DOCKER_REGISTRY=ghcr.io/commaai
-export COMMIT_SHA=$(git rev-parse HEAD)
-
-TAG_SUFFIX=$2
-LOCAL_TAG=$DOCKER_IMAGE$TAG_SUFFIX
-REMOTE_TAG=$DOCKER_REGISTRY/$LOCAL_TAG
-REMOTE_SHA_TAG=$DOCKER_REGISTRY/$LOCAL_TAG:$COMMIT_SHA
diff --git a/tools/install_python_dependencies.sh b/tools/install_python_dependencies.sh
index cdbaca32cf..6fa8138755 100755
--- a/tools/install_python_dependencies.sh
+++ b/tools/install_python_dependencies.sh
@@ -5,8 +5,9 @@ set -e
 export PIP_DEFAULT_TIMEOUT=200
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
-ROOT="$DIR"/../
-cd "$ROOT"
+echo DIR "$DIR"
+#ROOT="$DIR"/../
+#cd "$ROOT"
 
 if ! command -v "uv" > /dev/null 2>&1; then
   echo "installing uv..."
@@ -21,7 +22,7 @@ uv self update || true
 
 echo "installing python packages..."
 uv sync --frozen --all-extras
-source .venv/bin/activate
+source $HOME/.venv/bin/activate
 
 if [[ "$(uname)" == 'Darwin' ]]; then
   touch "$ROOT"/.env