diff --git a/Dockerfile b/Dockerfile
index d8dbadc6e..21f1e4023 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,18 @@
 # docker build --rm -t woodpeckerci/woodpecker-server .
 
-FROM drone/ca-certs
+# use golang image to copy ssl certs later
+FROM golang:1.16
+
+FROM scratch
+
+# copy certs from golang:1.16 image
+COPY --from=0 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 EXPOSE 8000 9000 80 443
 
+ENV GODEBUG=netdns=go
 ENV DATABASE_DRIVER=sqlite3
 ENV DATABASE_CONFIG=/var/lib/drone/drone.sqlite
-ENV GODEBUG=netdns=go
 ENV XDG_CACHE_HOME /var/lib/drone
 
 ADD release/drone-server /bin/
diff --git a/Dockerfile.agent b/Dockerfile.agent
index 95a4e669c..74c717b1b 100644
--- a/Dockerfile.agent
+++ b/Dockerfile.agent
@@ -1,6 +1,13 @@
 # docker build --rm -f Dockerfile.agent -t woodpeckerci/woodpecker-agent .
 
-FROM drone/ca-certs
+# use golang image to copy ssl certs later
+FROM golang:1.16
+
+FROM scratch
+
+# copy certs from golang:1.16 image
+COPY --from=0 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 ENV GODEBUG=netdns=go
 ADD release/drone-agent /bin/
 
diff --git a/Dockerfile.agent.alpine b/Dockerfile.agent.alpine
index 10c7252bd..7cf52284c 100644
--- a/Dockerfile.agent.alpine
+++ b/Dockerfile.agent.alpine
@@ -1,5 +1,4 @@
-FROM alpine:3.9.4
-
+FROM alpine:3.14
 RUN apk add -U --no-cache ca-certificates
 
 ENV GODEBUG=netdns=go
diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index a87da8f16..38ec3d240 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -1,11 +1,11 @@
-FROM alpine:3.9.4
-EXPOSE 8000 9000 80 443
-
+FROM alpine:3.14
 RUN apk add -U --no-cache ca-certificates
 
+EXPOSE 8000 9000 80 443
+
+ENV GODEBUG=netdns=go
 ENV DATABASE_DRIVER=sqlite3
 ENV DATABASE_CONFIG=/var/lib/drone/drone.sqlite
-ENV GODEBUG=netdns=go
 ENV XDG_CACHE_HOME /var/lib/drone
 
 ADD release/drone-server /bin/