diff --git a/.github/workflows/registry.yml b/.github/workflows/registry.yml
index f14f5b20d..b05d94971 100644
--- a/.github/workflows/registry.yml
+++ b/.github/workflows/registry.yml
@@ -99,9 +99,31 @@ jobs:
             docker.io/oamdev/vela-apiserver:${{ steps.get_version.outputs.VERSION }}
             ghcr.io/${{ github.repository }}/vela-apiserver:${{ steps.get_version.outputs.VERSION }}
 
+      - name: Build & Pushing vela CLI for ACR
+        run: |
+          docker build --build-arg GOPROXY=https://proxy.golang.org --build-arg VERSION=${{ steps.get_version.outputs.VERSION }} --build-arg GITVERSION=git-${{ steps.vars.outputs.git_revision }}  -t kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-cli:${{ steps.get_version.outputs.VERSION }} -f Dockerfile.cli .
+          docker push kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-cli:${{ steps.get_version.outputs.VERSION }}
+      - uses: docker/build-push-action@v2
+        name: Build & Pushing CLI for Dockerhub and GHCR
+        with:
+          context: .
+          file: Dockerfile.cli
+          labels: |-
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          build-args: |
+            GITVERSION=git-${{ steps.vars.outputs.git_revision }}
+            VERSION=${{ steps.get_version.outputs.VERSION }}
+            GOPROXY=https://proxy.golang.org
+          tags: |-
+            docker.io/oamdev/vela-cli:${{ steps.get_version.outputs.VERSION }}
+            ghcr.io/${{ github.repository }}/vela-cli:${{ steps.get_version.outputs.VERSION }}
+
       - name: Build & Pushing vela runtime rollout for ACR
         run: |
-          docker build --build-arg GOPROXY=https://proxy.golang.org --build-arg VERSION=${{ steps.get_version.outputs.VERSION }} --build-arg GITVERSION=git-${{ steps.vars.outputs.git_revision }}  -t kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }} .
+          docker build --build-arg GOPROXY=https://proxy.golang.org --build-arg VERSION=${{ steps.get_version.outputs.VERSION }} --build-arg GITVERSION=git-${{ steps.vars.outputs.git_revision }}  -t kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }} -f runtime/rollout/Dockerfile .
           docker push kubevela-registry.cn-hangzhou.cr.aliyuncs.com/oamdev/vela-rollout:${{ steps.get_version.outputs.VERSION }}
       - uses: docker/build-push-action@v2
         name: Build & Pushing runtime rollout for Dockerhub and GHCR
diff --git a/Dockerfile b/Dockerfile
index 2d6f91c55..36cfdd3ad 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,7 +36,7 @@ RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
 FROM ${BASE_IMAGE:-alpine:3.15}
-# This is required by daemon connnecting with cri
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash expat
 
 WORKDIR /
diff --git a/Dockerfile.apiserver b/Dockerfile.apiserver
index eb9a86771..38e09de79 100644
--- a/Dockerfile.apiserver
+++ b/Dockerfile.apiserver
@@ -34,7 +34,7 @@ RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
 
 FROM ${BASE_IMAGE:-alpine:3.15}
-# This is required by daemon connnecting with cri
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash expat
 
 WORKDIR /
diff --git a/Dockerfile.cli b/Dockerfile.cli
new file mode 100644
index 000000000..0fcd90c3d
--- /dev/null
+++ b/Dockerfile.cli
@@ -0,0 +1,43 @@
+ARG BASE_IMAGE
+# Build the cli binary
+FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.17-alpine as builder
+ARG GOPROXY
+ENV GOPROXY=${GOPROXY:-https://goproxy.cn}
+WORKDIR /workspace
+# Copy the Go Modules manifests
+COPY go.mod go.mod
+COPY go.sum go.sum
+# cache deps before building and copying source so that we don't need to re-download as much
+# and so that source changes don't invalidate our downloaded layer
+RUN go mod download
+
+# Copy the go source
+COPY apis/ apis/
+COPY pkg/ pkg/
+COPY version/ version/
+COPY references/ references/
+
+# Build
+ARG TARGETARCH
+ARG VERSION
+ARG GITVERSION
+
+RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} \
+    go build -a -ldflags "-s -w -X github.com/oam-dev/kubevela/version.VelaVersion=${VERSION:-undefined} -X github.com/oam-dev/kubevela/version.GitRevision=${GITVERSION:-undefined}" \
+    -o vela-${TARGETARCH} ./references/cmd/cli/main.go
+
+
+# Use alpine as base image due to the discussion in issue #1448
+# You can replace distroless as minimal base image to package the manager binary
+# Refer to https://github.com/GoogleContainerTools/distroless for more details
+# Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
+
+FROM ${BASE_IMAGE:-alpine:3.15}
+# This is required by daemon connecting with cri
+RUN apk add --no-cache ca-certificates bash expat
+
+WORKDIR /
+
+ARG TARGETARCH
+COPY --from=builder /workspace/vela-${TARGETARCH} /vela
+ENTRYPOINT ["/vela"]
diff --git a/Dockerfile.e2e b/Dockerfile.e2e
index 0e642e08e..9a21c40b8 100644
--- a/Dockerfile.e2e
+++ b/Dockerfile.e2e
@@ -39,7 +39,7 @@ RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
 
 FROM ${BASE_IMAGE:-alpine:3.15}
-# This is required by daemon connnecting with cri
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash expat
 
 WORKDIR /
diff --git a/makefiles/build.mk b/makefiles/build.mk
index 10dcc96d6..ce139db54 100644
--- a/makefiles/build.mk
+++ b/makefiles/build.mk
@@ -9,7 +9,7 @@ kubectl-vela:
 
 # Build the docker image
 .PHONY: docker-build
-docker-build: docker-build-core docker-build-apiserver
+docker-build: docker-build-core docker-build-apiserver docker-build-cli
 	@$(OK)
 
 .PHONY: docker-build-core
@@ -20,6 +20,10 @@ docker-build-core:
 docker-build-apiserver:
 	docker build --build-arg=VERSION=$(VELA_VERSION) --build-arg=GITVERSION=$(GIT_COMMIT) -t $(VELA_APISERVER_IMAGE) -f Dockerfile.apiserver .
 
+.PHONY: docker-build-cli
+docker-build-cli:
+	docker build --build-arg=VERSION=$(VELA_VERSION) --build-arg=GITVERSION=$(GIT_COMMIT) -t $(VELA_CLI_IMAGE)  -f Dockerfile.cli .
+
 # Build the runtime docker image
 .PHONY: docker-build-runtime-rollout
 docker-build-runtime-rollout:
diff --git a/makefiles/const.mk b/makefiles/const.mk
index 94f18b332..a849ced29 100644
--- a/makefiles/const.mk
+++ b/makefiles/const.mk
@@ -43,6 +43,7 @@ endif
 
 # Image URL to use all building/pushing image targets
 VELA_CORE_IMAGE      ?= vela-core:latest
+VELA_CLI_IMAGE      ?= oamdev/vela-cli:latest
 VELA_CORE_TEST_IMAGE ?= vela-core-test:$(GIT_COMMIT)
 VELA_APISERVER_IMAGE      ?= apiserver:latest
 VELA_RUNTIME_ROLLOUT_IMAGE       ?= vela-runtime-rollout:latest
diff --git a/references/cli/cli.go b/references/cli/cli.go
index c4162e096..78b71e2ab 100644
--- a/references/cli/cli.go
+++ b/references/cli/cli.go
@@ -130,10 +130,8 @@ func NewCommandWithIOStreams(ioStream util.IOStreams) *cobra.Command {
 		NewWorkloadsCommand(commandArgs, ioStream),
 	)
 
-	// this is for mute klog
 	fset := flag.NewFlagSet("logs", flag.ContinueOnError)
 	klog.InitFlags(fset)
-	_ = fset.Set("v", "-1")
 
 	// init global flags
 	cmds.PersistentFlags().BoolVarP(&assumeYes, "yes", "y", false, "Assume yes for all user prompts")
diff --git a/references/cmd/cli/main.go b/references/cmd/cli/main.go
index 8ee7ccb10..8ab72fdf3 100644
--- a/references/cmd/cli/main.go
+++ b/references/cmd/cli/main.go
@@ -17,8 +17,8 @@ limitations under the License.
 package main
 
 import (
+	"log"
 	"math/rand"
-	"os"
 	"time"
 
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
@@ -37,6 +37,6 @@ func main() {
 	command := cli.NewCommand()
 
 	if err := command.Execute(); err != nil {
-		os.Exit(1)
+		log.Fatal(err)
 	}
 }
diff --git a/runtime/rollout/Dockerfile b/runtime/rollout/Dockerfile
index 32a43e1c7..2061023a8 100644
--- a/runtime/rollout/Dockerfile
+++ b/runtime/rollout/Dockerfile
@@ -29,7 +29,7 @@ RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
 ARG BASE_IMAGE
 FROM ${BASE_IMAGE:-alpine:latest}
-# This is required by daemon connnecting with cri
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash
 
 WORKDIR /
diff --git a/runtime/rollout/e2e/Dockerfile.e2e b/runtime/rollout/e2e/Dockerfile.e2e
index c8018fa47..796157285 100644
--- a/runtime/rollout/e2e/Dockerfile.e2e
+++ b/runtime/rollout/e2e/Dockerfile.e2e
@@ -29,7 +29,7 @@ RUN GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
 # Overwrite `BASE_IMAGE` by passing `--build-arg=BASE_IMAGE=gcr.io/distroless/static:nonroot`
 ARG BASE_IMAGE
 FROM ${BASE_IMAGE:-alpine:latest}
-# This is required by daemon connnecting with cri
+# This is required by daemon connecting with cri
 RUN apk add --no-cache ca-certificates bash
 
 WORKDIR /