diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..ce9b583
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,80 @@
+*.rbc
+/.config
+/coverage/
+/InstalledFiles
+/pkg/
+/spec/reports/
+/spec/examples.txt
+/test/tmp/
+/test/version_tmp/
+/tmp/
+
+# Used by dotenv library to load environment variables.
+# .env
+
+## Specific to RubyMotion:
+.dat*
+.repl_history
+build/
+*.bridgesupport
+build-iPhoneOS/
+build-iPhoneSimulator/
+
+## Specific to RubyMotion (use of CocoaPods):
+#
+# We recommend against adding the Pods directory to your .gitignore. However
+# you should judge for yourself, the pros and cons are mentioned at:
+# https://guides.cocoapods.org/using/using-cocoapods.html#should-i-check-the-pods-directory-into-source-control
+#
+# vendor/Pods/
+
+## Documentation cache and generated files:
+/.yardoc/
+/_yardoc/
+/rdoc/
+
+## Environment normalization:
+/.bundle/
+/vendor/bundle
+/lib/bundler/man/
+
+# for a library or gem, you might want to ignore these files since the code is
+# intended to run in multiple environments; otherwise, check them in:
+# Gemfile.lock
+# .ruby-version
+# .ruby-gemset
+
+# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
+.rvmrc
+
+# Specifics for octocatalog-diff
+bin/bundler
+bin/facter
+bin/hiera
+bin/htmldiff
+bin/httparty
+bin/ldiff
+bin/parallel_cucumber
+bin/parallel_rspec
+bin/parallel_spinach
+bin/parallel_test
+bin/puppet
+bin/rake
+bin/rspec
+bin/rubocop
+bin/ruby-parse
+bin/ruby-rewrite
+bin/safe_yaml
+
+# Ignore config created during testing
+.puppet_version
+.parallel_runtime_rspec.log
+.parallel_runtime_integration.log
+.parallel_runtime_tests.log
+.rspec_parallel
+
+# Packaged gem
+/pkg/
+Gemfile.lock
+
+.git
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 390502f..1d6403c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,6 +2,11 @@ name: CI
 on: [push]
 jobs:
   puppet-3-8-7:
+    env:
+      PUPPET_VERSIONS: "3.8.7"
+      PUPPET_VERSION: "3.8.7"
+      RUBOCOP_TEST: false
+      RSPEC_TEST: true
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -9,22 +14,17 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v1
-      - name: bundle
-        run: |          
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "3.8.7" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rspec
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          bundle exec rspec spec/octocatalog-diff/integration
-    container:
-      image: ruby:${{matrix.ruby-version}}
-      env:
-        PUPPET_VERSION: "3.8.7"
+      - name: Build container
+        run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}}
+      - name: Tests
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
 
   puppet-4-10-10:
+    env:
+      PUPPET_VERSIONS: "4.10.10"
+      PUPPET_VERSION: "4.10.10"
+      RUBOCOP_TEST: false
+      RSPEC_TEST: true
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -32,22 +32,17 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "4.10.10" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: spec
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          bundle exec rspec spec/octocatalog-diff/integration
-    container:
-      image: ruby:${{matrix.ruby-version}}
-      env:
-        PUPPET_VERSION: "4.10.10"
+      - name: Build container
+        run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}}
+      - name: Tests
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
 
   puppet-5-5-8:
+    env:
+      PUPPET_VERSIONS: "5.5.8"
+      PUPPET_VERSION: "5.5.8"
+      RUBOCOP_TEST: false
+      RSPEC_TEST: true
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -55,56 +50,13 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "5.5.8" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rspec
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          bundle exec rspec spec/octocatalog-diff/integration
-    container:
-      image: ruby:${{matrix.ruby-version}}
-      env:
-        PUPPET_VERSION: "5.5.8"
-
-  rubocop:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "5.5.8" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rubocop
-        run: bundle exec rake rubocop
-    container:
-      image: "ruby:2.6"
-      env:
-        PUPPET_VERSION: "5.5.8"
-
-  coverage:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v1
-      - name: bundle
-        run: |
-          apt-get update
-          apt-get install -y cmake openssl libssl-dev
-          echo "5.5.8" > .puppet_version
-          bundle install --binstubs --jobs 4 --retry 3
-      - name: rubocop
-        run: |
-          bundle exec rspec spec/octocatalog-diff/tests
-          grep -q "100% test coverage. You're all set, friend" coverage/coverage.txt
-    container:
-      image: "ruby:2.6"
-      env:
-        PUPPET_VERSION: "5.5.8"
-        COVERAGE: true
+      - name: Build container
+        run: docker build . --file Dockerfile --tag octocatalog-diff:ruby${{matrix.ruby-version}} --build-arg RUBY_VERSION=${{matrix.ruby-version}}-stretch
+      - name: Tests
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
+      - name: Rubocop and Coverage
+        run: docker run -e PUPPET_VERSION -e PUPPET_VERSIONS -e RSPEC_TEST -e RUBOCOP_TEST -e ENFORCE_COVERAGE octocatalog-diff:ruby${{matrix.ruby-version}} /app/script/cibuild
+        if: matrix.ruby-version == '2.6'
+        env:
+          RUBOCOP_TEST: true
+          ENFORCE_COVERAGE: true
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b6234a6
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+ARG RUBY_VERSION="2.6"
+FROM ruby:${RUBY_VERSION} as ruby
+ARG RUBY_VERSION
+ENV RUBY_VERSION="${RUBY_VERSION}"
+RUN rm -rf $GEM_HOME $BUNDLE_PATH $BUNDLE_BIN $BUNDLE_APP_CONFIG
+RUN apt-get update && apt-get install -y cmake openssl libssl-dev
+RUN sed -i'' -e 's/CipherString = DEFAULT@SECLEVEL=2/CipherString = DEFAULT@SECLEVEL=1/g' /etc/ssl/openssl.cnf
+RUN sed -i'' -e 's/MinProtocol = TLSv1.2/MinProtocol = TLSv1/g' /etc/ssl/openssl.cnf
+
+FROM scratch AS app
+COPY --from=ruby / /
+WORKDIR /app
+ENV LANG="C.UTF-8"
+COPY . .
+#RUN gem install bundler -v 1.17.2
+RUN script/bootstrap
+
+CMD ["/app/script/cibuild"]