diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3b2c7727ea2561..870c60c9620211 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -83,9 +83,6 @@ jobs:
     name: Build with external toolchain
     needs: setup_build
     runs-on: self-hosted
-
-    container: ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }}
-
     permissions:
       contents: read
       packages: read
@@ -124,9 +121,13 @@ jobs:
           repository: openwrt/telephony
           path: openwrt/feeds/telephony
 
+
+      - name: Pull Docker image
+        run: |
+          sudo docker pull ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }}
       - name: Fix permission
         run: |
-          chown -R buildbot:buildbot openwrt
+          chmod -R 777 openwrt
 
       - name: Initialization environment
         run: |
@@ -137,12 +138,14 @@ jobs:
 
       - name: Update & Install feeds
         if: inputs.include_feeds == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           ./scripts/feeds update -a
           ./scripts/feeds install -a
 
+          INNER
+          EOF
       - name: Parse toolchain file
         if: inputs.build_toolchain == false
         id: parse-toolchain
@@ -218,45 +221,56 @@ jobs:
             | tar --xz -xf -
 
       - name: Extract prebuilt tools
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: ./scripts/ext-tools.sh --tools /tools.tar
+        run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
+          ./scripts/ext-tools.sh --tools /tools.tar
+          INNER
+          EOF
 
       - name: Configure testing kernel
         if: inputs.testing == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           echo CONFIG_TESTING_KERNEL=y >> .config
 
+          INNER
+          EOF
       - name: Configure all kernel modules
         if: inputs.build_all_kmods == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           echo CONFIG_ALL_KMODS=y >> .config
 
+          INNER
+          EOF
       - name: Configure all modules
         if: inputs.build_all_modules == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           echo CONFIG_ALL=y >> .config
 
+          INNER
+          EOF
       - name: Configure all boards
         if: inputs.build_all_boards == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           echo CONFIG_TARGET_MULTI_PROFILE=y >> .config
           echo CONFIG_TARGET_PER_DEVICE_ROOTFS=y >> .config
           echo CONFIG_TARGET_ALL_PROFILES=y >> .config
 
+          INNER
+          EOF
       - name: Configure external toolchain
         if: inputs.build_toolchain == false && steps.parse-toolchain.outputs.toolchain-type == 'external_toolchain'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           echo CONFIG_DEVEL=y >> .config
           echo CONFIG_AUTOREMOVE=y >> .config
           echo CONFIG_CCACHE=y >> .config
@@ -266,11 +280,13 @@ jobs:
             --overwrite-config \
             --config ${{ env.TARGET }}/${{ env.SUBTARGET }}
 
+          INNER
+          EOF
       - name: Adapt external sdk to external toolchain format
         if: inputs.build_toolchain == false && steps.parse-toolchain.outputs.toolchain-type == 'external_sdk' && steps.cache-external-toolchain.outputs.cache-hit != 'true'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           TOOLCHAIN_DIR=${{ env.TOOLCHAIN_FILE }}/staging_dir/$(ls ${{ env.TOOLCHAIN_FILE }}/staging_dir | grep toolchain)
           TOOLCHAIN_BIN=$TOOLCHAIN_DIR/bin
           OPENWRT_DIR=$(pwd)
@@ -294,11 +310,13 @@ jobs:
             ln -sf $GNU_TARGET_NAME-wrapper.sh $GNU_TARGET_NAME-$app
           done
 
+          INNER
+          EOF
       - name: Configure external toolchain with sdk
         if: inputs.build_toolchain == false && steps.parse-toolchain.outputs.toolchain-type == 'external_sdk'
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           echo CONFIG_DEVEL=y >> .config
           echo CONFIG_AUTOREMOVE=y >> .config
           echo CONFIG_CCACHE=y >> .config
@@ -308,11 +326,13 @@ jobs:
             --overwrite-config \
             --config ${{ env.TARGET }}/${{ env.SUBTARGET }}
 
+          INNER
+          EOF
       - name: Configure internal toolchain
         if: inputs.build_toolchain == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
         run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
           echo CONFIG_DEVEL=y >> .config
           echo CONFIG_AUTOREMOVE=y >> .config
           echo CONFIG_CCACHE=y >> .config
@@ -322,36 +342,56 @@ jobs:
 
           make defconfig
 
+          INNER
+          EOF
       - name: Show configuration
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: ./scripts/diffconfig.sh
+        run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
+          ./scripts/diffconfig.sh
+          INNER
+          EOF
 
       - name: Build tools
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make tools/install -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+        run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
+          make tools/install -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+          INNER
+          EOF
 
       - name: Build toolchain
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make toolchain/install -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+        run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
+          make toolchain/install -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+          INNER
+          EOF
 
       - name: Build Kernel
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make target/compile -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+        run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
+          make target/compile -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+          INNER
+          EOF
 
       - name: Build Kernel Kmods
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make package/linux/compile -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+        run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
+          make package/linux/compile -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+          INNER
+          EOF
 
       - name: Build everything
         if: inputs.build_full == true
-        shell: su buildbot -c "sh -e {0}"
-        working-directory: openwrt
-        run: make -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+        run: |
+          sudo docker run -i --rm -v $GITHUB_WORKSPACE:/workspace -w /workspace/openwrt -e TARGET=$TARGET -e SUBTARGET=$SUBTARGET -e TOOLCHAIN_FILE=$TOOLCHAIN_FILE -e TOOLCHAIN_PATH=$TOOLCHAIN_PATH -e TOOLCHAIN_SHA256=$TOOLCHAIN_SHA256 ghcr.io/${{ needs.setup_build.outputs.owner_lc }}/tools:${{ needs.setup_build.outputs.container_tag }} /bin/bash <<'EOF'
+          su buildbot -c "sh -e" <<'INNER'
+          make -j$(($(nproc)+1)) --load-average=$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
+          INNER
+          EOF
 
       - name: Upload logs
         if: failure()