diff --git a/.github/workflows/pull-cd-builder-images-centos7.yaml b/.github/workflows/pull-cd-builder-images-centos7.yaml
new file mode 100644
index 00000000..c7c7e208
--- /dev/null
+++ b/.github/workflows/pull-cd-builder-images-centos7.yaml
@@ -0,0 +1,118 @@
+name: Pull test for CD builder images
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "dockerfiles/cd/builders/*/centos7/Dockerfile"
+      - "dockerfiles/cd/builders/*/centos7/*.Dockerfile"
+      - "dockerfiles/cd/builders/skaffold-centos7.yaml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  skaffold-go:
+    name: build images with skaffold
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    strategy:
+      matrix:
+        module: [builder-go]
+        go-profile: [go-1.23, go-1.22, go-1.21, go-1.20, go-1.19]
+        platform: [linux/amd64, linux/arm64]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: '0'
+          fetch-tags: 'true'
+
+      # https://github.com/docker/setup-qemu-action
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
+          sudo install skaffold /usr/local/bin/
+
+      - name: Build images
+        working-directory: dockerfiles/cd/builders
+        run: |
+          skaffold build \
+            --filename=skaffold-centos7.yaml \
+            --build-concurrency=1 \
+            --cache-artifacts \
+            --default-repo=ghcr.io/pingcap-qe/cd/builders \
+            --module=${{ matrix.module }} \
+            --profile=${{ matrix.go-profile }} \
+            --platform=${{ matrix.platform }} \
+            --push=false
+
+  skaffold-nogo:
+    name: build images with skaffold
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    strategy:
+      matrix:
+        module: [builder-tiflash, builder-tikv]
+        platform: [linux/amd64, linux/arm64]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: '0'
+          fetch-tags: 'true'
+
+      # https://github.com/docker/setup-qemu-action
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
+          sudo install skaffold /usr/local/bin/
+
+      - name: Build images
+        working-directory: dockerfiles/cd/builders
+        run: |
+          skaffold build \
+            --filename=skaffold-centos7.yaml \
+            --build-concurrency=1 \
+            --cache-artifacts \
+            --default-repo=ghcr.io/pingcap-qe/cd/builders \
+            --module=${{ matrix.module }} \
+            --platform=${{ matrix.platform }} \
+            --push=false
diff --git a/.github/workflows/pull-cd-builder-images.yaml b/.github/workflows/pull-cd-builder-images.yaml
index 4b0e4ba4..d2f58830 100644
--- a/.github/workflows/pull-cd-builder-images.yaml
+++ b/.github/workflows/pull-cd-builder-images.yaml
@@ -4,8 +4,8 @@ on:
     branches:
       - main
     paths:
-      - "dockerfiles/cd/builders/**/Dockerfile"
-      - "dockerfiles/cd/builders/**/*.Dockerfile"
+      - "dockerfiles/cd/builders/*/Dockerfile"
+      - "dockerfiles/cd/builders/*/*.Dockerfile"
       - "dockerfiles/cd/builders/skaffold.yaml"
 
 concurrency:
@@ -25,7 +25,6 @@ jobs:
       matrix:
         module: [builder-go]
         go-profile: [go-1.23, go-1.22, go-1.21]
-        builder-profile: [local-docker]
         platform: [linux/amd64, linux/arm64]
     steps:
       - name: Checkout sources
@@ -54,25 +53,16 @@ jobs:
           curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
           sudo install skaffold /usr/local/bin/
 
-      - name: Cache layers
-        uses: actions/cache@v4
-        with:
-          path: "~/.skaffold/cache"
-          key: skaffold/${{ matrix.platform }}/cd/${{ matrix.module }}/${{ matrix.go-profile }}-${{ github.sha }}
-          restore-keys: |
-            skaffold/${{ matrix.platform }}/cd/${{ matrix.module }}/${{ matrix.go-profile }}-
-            skaffold/${{ matrix.platform }}/cd/${{ matrix.module }}/
-
       - name: Build images
         working-directory: dockerfiles/cd/builders
         run: |
           skaffold build \
-            --build-concurrency 1 \
+            --build-concurrency=1 \
             --cache-artifacts \
-            --default-repo ghcr.io/pingcap-qe/cd/builders \
-            --module ${{ matrix.module }} \
-            --platform ${{ matrix.platform }} \
-            --profile ${{ matrix.go-profile }},${{ matrix.builder-profile }} \
+            --default-repo=ghcr.io/pingcap-qe/cd/builders \
+            --module=${{ matrix.module }} \
+            --profile=${{ matrix.go-profile }} \
+            --platform=${{ matrix.platform }} \
             --push=false
 
   skaffold-nogo:
@@ -85,9 +75,8 @@ jobs:
 
     strategy:
       matrix:
-        module: [builder-tiflash, builder-tikv, builder-tikv-fips, builder-others]
+        module: [builder-tiflash, builder-tikv, builder-tikv-fips]
         platform: [linux/amd64, linux/arm64]
-        builder-profile: [local-docker]
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -115,23 +104,13 @@ jobs:
           curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
           sudo install skaffold /usr/local/bin/
 
-      - name: Cache layers
-        uses: actions/cache@v4
-        with:
-          path: "~/.skaffold/cache"
-          key: skaffold/${{ matrix.platform }}/cd/${{ matrix.module }}-${{ github.sha }}
-          restore-keys: |
-            skaffold/${{ matrix.platform }}/cd/${{ matrix.module }}-
-            skaffold/${{ matrix.platform }}/cd/${{ matrix.module }}/
-
       - name: Build images
         working-directory: dockerfiles/cd/builders
         run: |
           skaffold build \
-            --build-concurrency 1 \
+            --build-concurrency=1 \
             --cache-artifacts \
-            --default-repo ghcr.io/pingcap-qe/cd/builders \
-            --module ${{ matrix.module }} \
-            --platform ${{ matrix.platform }} \
-            --profile ${{ matrix.builder-profile }} \
+            --default-repo=ghcr.io/pingcap-qe/cd/builders \
+            --module=${{ matrix.module }} \
+            --platform=${{ matrix.platform }} \
             --push=false
diff --git a/.github/workflows/release-cd-builder-images-centos7.yaml b/.github/workflows/release-cd-builder-images-centos7.yaml
new file mode 100644
index 00000000..89dfdee7
--- /dev/null
+++ b/.github/workflows/release-cd-builder-images-centos7.yaml
@@ -0,0 +1,107 @@
+name: Publish CD builder images
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "dockerfiles/cd/builders/*/centos7/Dockerfile"
+      - "dockerfiles/cd/builders/*/centos7/*.Dockerfile"
+      - "dockerfiles/cd/builders/skaffold-centos7.yaml"
+
+jobs:
+  skaffold-go:
+    name: publish images with skaffold
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    strategy:
+      matrix:
+        module: [builder-go]
+        go-profile: [go-1.23, go-1.22, go-1.21, go-1.20, go-1.19]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: '0'
+          fetch-tags: 'true'
+
+      # https://github.com/docker/setup-qemu-action
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
+          sudo install skaffold /usr/local/bin/
+
+      - name: Publish images
+        working-directory: dockerfiles/cd/builders
+        run: |
+          skaffold build \
+            --filename=skaffold-centos7.yaml \
+            --build-concurrency=1 \
+            --cache-artifacts \
+            --default-repo=ghcr.io/pingcap-qe/cd/builders \
+            --module=${{ matrix.module }} \
+            --profile=${{ matrix.go-profile }}
+  skaffold-nogo:
+    name: publish images with skaffold
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        module: [builder-tiflash, builder-tikv]
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: '0'
+          fetch-tags: 'true'
+
+      # https://github.com/docker/setup-qemu-action
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup skaffold
+        run: |
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
+          sudo install skaffold /usr/local/bin/
+
+      - name: Publish images
+        working-directory: dockerfiles/cd/builders
+        run: |
+          skaffold build \
+            --filename=skaffold-centos7.yaml \
+            --build-concurrency=1 \
+            --cache-artifacts \
+            --default-repo=ghcr.io/pingcap-qe/cd/builders \
+            --module=${{ matrix.module }}
diff --git a/.github/workflows/release-cd-builder-images.yaml b/.github/workflows/release-cd-builder-images.yaml
index e16b13e4..1a362574 100644
--- a/.github/workflows/release-cd-builder-images.yaml
+++ b/.github/workflows/release-cd-builder-images.yaml
@@ -5,8 +5,8 @@ on:
     branches:
       - main
     paths:
-      - "dockerfiles/cd/builders/**/Dockerfile"
-      - "dockerfiles/cd/builders/**/*.Dockerfile"
+      - "dockerfiles/cd/builders/*/Dockerfile"
+      - "dockerfiles/cd/builders/*/*.Dockerfile"
       - "dockerfiles/cd/builders/skaffold.yaml"
 
 jobs:
@@ -22,7 +22,6 @@ jobs:
       matrix:
         module: [builder-go]
         go-profile: [go-1.23, go-1.22, go-1.21]
-        builder-profile: [local-docker]
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -50,15 +49,6 @@ jobs:
           curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
           sudo install skaffold /usr/local/bin/
 
-      - name: Cache layers
-        uses: actions/cache@v4
-        with:
-          path: "~/.skaffold/cache"
-          key: skaffold/cd/${{ matrix.module }}/${{ matrix.go-profile }}-${{ github.sha }}
-          restore-keys: |
-            skaffold/cd/${{ matrix.module }}/${{ matrix.go-profile }}-
-            skaffold/cd/${{ matrix.module }}/
-
       - name: Publish images
         working-directory: dockerfiles/cd/builders
         run: |
@@ -67,7 +57,7 @@ jobs:
             --cache-artifacts \
             --default-repo ghcr.io/pingcap-qe/cd/builders \
             --module ${{ matrix.module }} \
-            --profile ${{ matrix.go-profile }},${{ matrix.builder-profile }}
+            --profile ${{ matrix.go-profile }}
   skaffold-nogo:
     name: publish images with skaffold
     runs-on: ubuntu-latest
@@ -77,8 +67,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        module: [builder-tiflash, builder-tikv, builder-tikv-fips, builder-others]
-        builder-profile: [local-docker]
+        module: [builder-tiflash, builder-tikv, builder-tikv-fips]
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -106,14 +95,6 @@ jobs:
           curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.13.2/skaffold-linux-amd64 && \
           sudo install skaffold /usr/local/bin/
 
-      - name: Cache layers
-        uses: actions/cache@v4
-        with:
-          path: "~/.skaffold/cache"
-          key: skaffold/cd/${{ matrix.module }}-${{ github.sha }}
-          restore-keys: |
-            skaffold/cd/${{ matrix.module }}-
-
       - name: Publish images
         working-directory: dockerfiles/cd/builders
         run: |
@@ -121,5 +102,4 @@ jobs:
             --build-concurrency 1 \
             --cache-artifacts \
             --default-repo ghcr.io/pingcap-qe/cd/builders \
-            --module ${{ matrix.module }} \
-            --profile ${{ matrix.builder-profile }}
+            --module ${{ matrix.module }}
diff --git a/dockerfiles/cd/builders/ng-monitoring/centos7/Dockerfile b/dockerfiles/cd/builders/ng-monitoring/centos7/Dockerfile
new file mode 100644
index 00000000..07bd1c55
--- /dev/null
+++ b/dockerfiles/cd/builders/ng-monitoring/centos7/Dockerfile
@@ -0,0 +1,49 @@
+# build requires:
+#   - docker >= v20.10
+#
+# build steps:
+#   - git clone https://github.com/pingcap/tidb.git tidb
+#   - rm tidb/.dockerignore # make step depended on git metadata.
+#   - docker build -t tidb -f Dockerfile ./tidb
+
+########### stage: Builder
+FROM centos:7.9.2009 as builder
+# CentOS 7 has reached EOL
+RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
+
+# install packages.
+RUN yum update --nogpgcheck -y && \
+    yum install --nogpgcheck -y epel-release deltarpm && \
+    yum update --nogpgcheck -y && \
+    yum groupinstall --nogpgcheck -y "Development Tools" && \
+    yum install -y wget && \
+    yum clean all
+
+# install golang toolchain
+# renovate: datasource=docker depName=golang
+ARG GOLANG_VERSION=1.21.13
+RUN OS=linux; ARCH=$([ "$(arch)" = "x86_64" ] && echo amd64 || echo arm64); \
+    curl -fsSL https://dl.google.com/go/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz | tar -C /usr/local -xz
+ENV PATH /usr/local/go/bin/:$PATH
+LABEL go-version="${GOLANG_VERSION}"
+
+########### stage: Buiding
+FROM builder as building
+COPY . /ws
+ARG GOPROXY
+RUN GOPROXY=${GOPROXY} make default -C /ws
+RUN /ws/bin/ng-monitoring-server -V
+
+########### stage: Final image
+FROM ghcr.io/pingcap-qe/bases/ng-monitoring-base:v1.9.1
+
+COPY --from=building /ws/bin/ng-monitoring-server /ng-monitoring-server
+
+WORKDIR /
+EXPOSE 12020
+ENTRYPOINT ["/ng-monitoring-server"]
+
+# test it
+RUN /ng-monitoring-server -V
diff --git a/dockerfiles/cd/builders/pd/centos7/Dockerfile b/dockerfiles/cd/builders/pd/centos7/Dockerfile
new file mode 100644
index 00000000..442c7418
--- /dev/null
+++ b/dockerfiles/cd/builders/pd/centos7/Dockerfile
@@ -0,0 +1,51 @@
+# build requires:
+#   - docker >= v20.10
+#
+# build steps:
+#   - git clone --recurse-submodules https://github.com/tikv/pd.git pd
+#   - docker build -t pd -f Dockerfile ./pd
+
+########### stage: Builder
+FROM centos:7.9.2009 as builder
+# CentOS 7 has reached EOL
+RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
+
+# install packages.
+RUN yum update --nogpgcheck -y && \
+    yum install --nogpgcheck -y epel-release deltarpm && \
+    yum update --nogpgcheck -y && \
+    yum groupinstall --nogpgcheck -y "Development Tools" && \
+    yum install --nogpgcheck -y which && \
+    yum clean all
+
+# install golang toolchain
+# renovate: datasource=docker depName=golang
+ARG GOLANG_VERSION=1.21.6
+RUN OS=linux; ARCH=$([ "$(arch)" = "x86_64" ] && echo amd64 || echo arm64); \
+    curl -fsSL https://dl.google.com/go/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz | tar -C /usr/local -xz
+ENV PATH /usr/local/go/bin/:$PATH
+LABEL go-version="${GOLANG_VERSION}"
+
+########### stage: Buiding
+FROM builder as building
+COPY . /pd
+ARG GOPROXY
+RUN GOPROXY=${GOPROXY} make build tools -C /pd
+RUN /pd/bin/pd-server -V
+RUN /pd/bin/pd-ctl -V
+RUN /pd/bin/pd-recover -V
+
+########### stage: Final image
+FROM ghcr.io/pingcap-qe/bases/pd-base:v1.9.1
+
+COPY --from=building /pd/bin/pd-server  /pd-server
+COPY --from=building /pd/bin/pd-ctl     /pd-ctl
+COPY --from=building /pd/bin/pd-recover /pd-recover
+
+EXPOSE 2379 2380
+ENTRYPOINT ["/pd-server"]
+
+# test it
+RUN /pd-server -V
diff --git a/dockerfiles/cd/builders/skaffold-centos7.yaml b/dockerfiles/cd/builders/skaffold-centos7.yaml
new file mode 100644
index 00000000..b0371568
--- /dev/null
+++ b/dockerfiles/cd/builders/skaffold-centos7.yaml
@@ -0,0 +1,228 @@
+---
+apiVersion: skaffold/v4beta6
+kind: Config
+metadata:
+  name: builder-go
+build:
+  artifacts:
+    - image: tidb
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: tidb/centos7/Dockerfile
+        target: builder
+    - image: tiflow
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: tiflow/centos7/Dockerfile
+        target: builder
+    - image: pd
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: pd/centos7/Dockerfile
+        target: builder
+    - image: ng-monitoring
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: ng-monitoring/centos7/Dockerfile
+        target: builder
+    - image: tidb-dashboard
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: tidb-dashboard/centos7/Dockerfile
+        target: builder
+  tagPolicy:
+    customTemplate:
+      template: "{{ .SHA }}-centos7"
+      components:
+        - name: SHA
+          gitCommit:
+            variant: Tags
+  local:
+    useDockerCLI: true
+    useBuildkit: true
+    concurrency: 0
+    tryImportMissing: true
+profiles:
+  - name: go-1.23
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-go1.23"
+      - op: add
+        path: /build/artifacts/0/docker/buildArgs
+        value: &value-go1-23
+          # renovate: datasource=docker depName=golang
+          GOLANG_VERSION: 1.23.1
+      - op: add
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-23
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
+        value: *value-go1-23
+      - op: add
+        path: /build/artifacts/3/docker/buildArgs
+        value: *value-go1-23
+      - op: add
+        path: /build/artifacts/4/docker/buildArgs
+        value: *value-go1-23
+  - name: go-1.22
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-go1.22"
+      - op: add
+        path: /build/artifacts/0/docker/buildArgs
+        value: &value-go1-22
+          # renovate: datasource=docker depName=golang
+          GOLANG_VERSION: 1.22.7
+      - op: add
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-22
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
+        value: *value-go1-22
+      - op: add
+        path: /build/artifacts/3/docker/buildArgs
+        value: *value-go1-22
+      - op: add
+        path: /build/artifacts/4/docker/buildArgs
+        value: *value-go1-22
+  - name: go-1.21
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-go1.21"
+      - op: add
+        path: /build/artifacts/0/docker/buildArgs
+        value: &value-go1-21
+          GOLANG_VERSION: 1.21.13
+      - op: add
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-21
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
+        value: *value-go1-21
+      - op: add
+        path: /build/artifacts/3/docker/buildArgs
+        value: *value-go1-21
+      - op: add
+        path: /build/artifacts/4/docker/buildArgs
+        value: *value-go1-21
+  - name: go-1.20
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-go1.20"
+      - op: add
+        path: /build/artifacts/0/docker/buildArgs
+        value: &value-go1-20
+          GOLANG_VERSION: 1.20.14
+      - op: add
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-20
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
+        value: *value-go1-20
+      - op: add
+        path: /build/artifacts/3/docker/buildArgs
+        value: *value-go1-20
+      - op: add
+        path: /build/artifacts/4/docker/buildArgs
+        value: *value-go1-20
+  - name: go-1.19
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-go1.19"
+      - op: add
+        path: /build/artifacts/0/docker/buildArgs
+        value: &value-go1-19
+          GOLANG_VERSION: 1.19.13
+      - op: add
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-19
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
+        value: *value-go1-19
+      - op: add
+        path: /build/artifacts/3/docker/buildArgs
+        value: *value-go1-19
+      - op: add
+        path: /build/artifacts/4/docker/buildArgs
+        value: *value-go1-19
+---
+apiVersion: skaffold/v4beta6
+kind: Config
+metadata:
+  name: builder-tikv
+build:
+  artifacts:
+    - image: tikv
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: tikv/centos7/Dockerfile
+        target: builder
+  local:
+    useDockerCLI: true
+    useBuildkit: true
+    concurrency: 0
+    tryImportMissing: true
+  tagPolicy:
+    customTemplate:
+      template: "{{ .SHA }}-centos7"
+      components:
+        - name: SHA
+          gitCommit:
+            variant: Tags
+profiles:
+  - name: devtoolset8
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-devtoolset8"
+      - op: add
+        path: /build/artifacts/0/kaniko/buildArgs
+        value:
+          DEVTOOLSET_VER: 8
+  - name: devtoolset9
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-devtoolset9"
+      - op: add
+        path: /build/artifacts/0/kaniko/buildArgs
+        value:
+          DEVTOOLSET_VER: 9
+  - name: devtoolset10
+    patches:
+      - op: replace
+        path: /build/tagPolicy/customTemplate/template
+        value: "{{ .SHA }}-centos7-devtoolset10"
+      - op: add
+        path: /build/artifacts/0/kaniko/buildArgs
+        value:
+          DEVTOOLSET_VER: 10
+---
+apiVersion: skaffold/v4beta6
+kind: Config
+metadata:
+  name: builder-tiflash
+build:
+  artifacts:
+    - image: tiflash
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: tiflash/centos7/Dockerfile
+        target: builder
+  local:
+    useDockerCLI: true
+    useBuildkit: true
+    concurrency: 0
+    tryImportMissing: true
+  tagPolicy:
+    customTemplate:
+      template: "{{ .SHA }}-centos7"
+      components:
+        - name: SHA
+          gitCommit:
+            variant: Tags
diff --git a/dockerfiles/cd/builders/skaffold.yaml b/dockerfiles/cd/builders/skaffold.yaml
index 07a0bfcb..49dfe1f6 100644
--- a/dockerfiles/cd/builders/skaffold.yaml
+++ b/dockerfiles/cd/builders/skaffold.yaml
@@ -1,4 +1,4 @@
-# Ref: https://skaffold.dev/docs/builders/builder-types/docker/#dockerfile-in-cluster-with-kaniko
+# yaml-language-server: $schema=https://github.com/GoogleContainerTools/skaffold/raw/refs/heads/main/docs-v2/content/en/schemas/v4beta6.json
 ---
 apiVersion: skaffold/v4beta6
 kind: Config
@@ -8,27 +8,33 @@ build:
   artifacts:
     - image: tidb
       platforms: [linux/amd64, linux/arm64]
-      kaniko:
+      docker:
         dockerfile: tidb/Dockerfile
-        cache: {}
         target: builder
     - image: tiflow
       platforms: [linux/amd64, linux/arm64]
-      kaniko:
+      docker:
         dockerfile: tiflow/Dockerfile
-        cache: {}
         target: builder
     - image: pd
       platforms: [linux/amd64, linux/arm64]
-      kaniko:
+      docker:
         dockerfile: pd/Dockerfile
-        cache: {}
         target: builder
     - image: ng-monitoring
       platforms: [linux/amd64, linux/arm64]
-      kaniko:
+      docker:
         dockerfile: ng-monitoring/Dockerfile
-        cache: {}
+        target: builder
+    - image: tidb-dashboard
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: tidb-dashboard/Dockerfile
+        target: builder
+    - image: tidb-operator
+      platforms: [linux/amd64, linux/arm64]
+      docker:
+        dockerfile: tidb-operator/Dockerfile
         target: builder
   tagPolicy:
     customTemplate:
@@ -37,47 +43,36 @@ build:
         - name: SHA
           gitCommit:
             variant: Tags
-  cluster:
+  local:
+    useDockerCLI: true
+    useBuildkit: true
     concurrency: 0
-    randomDockerConfigSecret: false
-    randomPullSecret: false
-    dockerConfig:
-      secretName: hub-pingcap-net-ee
-    resources:
-      limits:
-        cpu: "4"
-        memory: 8Gi
+    tryImportMissing: true
 profiles:
-  - name: local-docker
-    build:
-      local:
-        useDockerCLI: true
-        useBuildkit: true
-        concurrency: 0
-        tryImportMissing: true
-    patches:
-      - { op: move, from: /build/artifacts/0/kaniko, path: /build/artifacts/0/docker }
-      - { op: move, from: /build/artifacts/1/kaniko, path: /build/artifacts/1/docker }
-      - { op: move, from: /build/artifacts/2/kaniko, path: /build/artifacts/2/docker }
-      - { op: move, from: /build/artifacts/3/kaniko, path: /build/artifacts/3/docker }
   - name: go-1.23
     patches:
       - op: replace
         path: /build/tagPolicy/customTemplate/template
         value: "{{ .SHA }}-go1.23"
       - op: add
-        path: /build/artifacts/0/kaniko/buildArgs
+        path: /build/artifacts/0/docker/buildArgs
         value: &value-go1-23
           # renovate: datasource=docker depName=golang
           GOLANG_VERSION: 1.23.1
       - op: add
-        path: /build/artifacts/1/kaniko/buildArgs
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-23
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
         value: *value-go1-23
       - op: add
-        path: /build/artifacts/2/kaniko/buildArgs
+        path: /build/artifacts/3/docker/buildArgs
         value: *value-go1-23
       - op: add
-        path: /build/artifacts/3/kaniko/buildArgs
+        path: /build/artifacts/4/docker/buildArgs
+        value: *value-go1-23
+      - op: add
+        path: /build/artifacts/5/docker/buildArgs
         value: *value-go1-23
   - name: go-1.22
     patches:
@@ -85,18 +80,24 @@ profiles:
         path: /build/tagPolicy/customTemplate/template
         value: "{{ .SHA }}-go1.22"
       - op: add
-        path: /build/artifacts/0/kaniko/buildArgs
+        path: /build/artifacts/0/docker/buildArgs
         value: &value-go1-22
           # renovate: datasource=docker depName=golang
           GOLANG_VERSION: 1.22.7
       - op: add
-        path: /build/artifacts/1/kaniko/buildArgs
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-22
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
+        value: *value-go1-22
+      - op: add
+        path: /build/artifacts/3/docker/buildArgs
         value: *value-go1-22
       - op: add
-        path: /build/artifacts/2/kaniko/buildArgs
+        path: /build/artifacts/4/docker/buildArgs
         value: *value-go1-22
       - op: add
-        path: /build/artifacts/3/kaniko/buildArgs
+        path: /build/artifacts/5/docker/buildArgs
         value: *value-go1-22
   - name: go-1.21
     patches:
@@ -104,19 +105,24 @@ profiles:
         path: /build/tagPolicy/customTemplate/template
         value: "{{ .SHA }}-go1.21"
       - op: add
-        path: /build/artifacts/0/kaniko/buildArgs
+        path: /build/artifacts/0/docker/buildArgs
         value: &value-go1-21
           GOLANG_VERSION: 1.21.13
       - op: add
-        path: /build/artifacts/1/kaniko/buildArgs
+        path: /build/artifacts/1/docker/buildArgs
+        value: *value-go1-21
+      - op: add
+        path: /build/artifacts/2/docker/buildArgs
+        value: *value-go1-21
+      - op: add
+        path: /build/artifacts/3/docker/buildArgs
         value: *value-go1-21
       - op: add
-        path: /build/artifacts/2/kaniko/buildArgs
+        path: /build/artifacts/4/docker/buildArgs
         value: *value-go1-21
       - op: add
-        path: /build/artifacts/3/kaniko/buildArgs
+        path: /build/artifacts/5/docker/buildArgs
         value: *value-go1-21
-
 ---
 apiVersion: skaffold/v4beta6
 kind: Config
@@ -126,122 +132,21 @@ build:
   artifacts:
     - image: tikv
       platforms: [linux/amd64, linux/arm64]
-      kaniko:
+      docker:
         dockerfile: tikv/Dockerfile
-        cache: {}
         target: builder
-  tagPolicy:
-    customTemplate:
-      template: "{{ .SHA }}"
-      components:
-        - name: SHA
-          gitCommit:
-            variant: Tags
-  cluster:
+  local:
+    useDockerCLI: true
+    useBuildkit: true
     concurrency: 0
-    randomDockerConfigSecret: false
-    randomPullSecret: false
-    dockerConfig:
-      secretName: hub-pingcap-net-ee
-    resources:
-      limits:
-        cpu: "8"
-        memory: 32Gi
-profiles:
-  - name: local-docker
-    build:
-      local:
-        useDockerCLI: true
-        useBuildkit: true
-        concurrency: 0
-        tryImportMissing: true
-    patches:
-      - { op: move, from: /build/artifacts/0/kaniko, path: /build/artifacts/0/docker }
----
-apiVersion: skaffold/v4beta6
-kind: Config
-metadata:
-  name: builder-others
-build:
-  artifacts:
-    - image: tidb-dashboard
-      platforms: [linux/amd64, linux/arm64]
-      kaniko:
-        dockerfile: tidb-dashboard/Dockerfile
-        cache: {}
-        target: builder
-    - image: tidb-operator
-      platforms: [linux/amd64, linux/arm64]
-      kaniko:
-        dockerfile: tidb-operator/Dockerfile
-        cache: {}
-        target: builder
+    tryImportMissing: true
   tagPolicy:
     customTemplate:
-      template: "{{ .SHA }}"
+      template: "{{ .SHA }}-centos7"
       components:
         - name: SHA
           gitCommit:
             variant: Tags
-  cluster:
-    concurrency: 0
-    randomDockerConfigSecret: false
-    randomPullSecret: false
-    dockerConfig:
-      secretName: hub-pingcap-net-ee
-    resources:
-      limits:
-        cpu: "4"
-        memory: 8Gi
-profiles:
-  - name: local-docker
-    build:
-      local:
-        useDockerCLI: true
-        useBuildkit: true
-        concurrency: 0
-        tryImportMissing: true
-    patches:
-      - { op: move, from: /build/artifacts/0/kaniko, path: /build/artifacts/0/docker }
-      - { op: move, from: /build/artifacts/1/kaniko, path: /build/artifacts/1/docker }
-  - name: go-1.23
-    patches:
-      - op: replace
-        path: /build/tagPolicy/customTemplate/template
-        value: "{{ .SHA }}-go1.23"
-      - op: add
-        path: /build/artifacts/0/kaniko/buildArgs
-        value: &value-go1-23
-          # renovate: datasource=docker depName=golang
-          GOLANG_VERSION: 1.23.1
-      - op: add
-        path: /build/artifacts/1/kaniko/buildArgs
-        value: *value-go1-23
-  - name: go-1.22
-    patches:
-      - op: replace
-        path: /build/tagPolicy/customTemplate/template
-        value: "{{ .SHA }}-go1.23"
-      - op: add
-        path: /build/artifacts/0/kaniko/buildArgs
-        value: &value-go1-22
-          # renovate: datasource=docker depName=golang
-          GOLANG_VERSION: 1.22.7
-      - op: add
-        path: /build/artifacts/1/kaniko/buildArgs
-        value: *value-go1-22
-  - name: go-1.21
-    patches:
-      - op: replace
-        path: /build/tagPolicy/customTemplate/template
-        value: "{{ .SHA }}-go1.23"
-      - op: add
-        path: /build/artifacts/0/kaniko/buildArgs
-        value: &value-go1-21
-          GOLANG_VERSION: 1.21.13
-      - op: add
-        path: /build/artifacts/1/kaniko/buildArgs
-        value: *value-go1-21
 ---
 apiVersion: skaffold/v4beta6
 kind: Config
@@ -251,30 +156,14 @@ build:
   artifacts:
     - image: tiflash
       platforms: [linux/amd64, linux/arm64]
-      kaniko:
+      docker:
         dockerfile: tiflash/Dockerfile
-        cache: {}
         target: builder
-  cluster:
+  local:
+    useDockerCLI: true
+    useBuildkit: true
     concurrency: 0
-    randomDockerConfigSecret: false
-    randomPullSecret: false
-    dockerConfig:
-      secretName: hub-pingcap-net-ee
-    resources:
-      limits:
-        cpu: "8"
-        memory: 32Gi
-profiles:
-  - name: local-docker
-    build:
-      local:
-        useDockerCLI: true
-        useBuildkit: true
-        concurrency: 0
-        tryImportMissing: true
-    patches:
-      - { op: move, from: /build/artifacts/0/kaniko, path: /build/artifacts/0/docker }
+    tryImportMissing: true
 ---
 apiVersion: skaffold/v4beta6
 kind: Config
@@ -284,9 +173,8 @@ build:
   artifacts:
     - image: tikv
       platforms: [linux/amd64, linux/arm64]
-      kaniko:
+      docker:
         dockerfile: tikv/fips.Dockerfile
-        cache: {}
         target: builder
   tagPolicy:
     customTemplate:
@@ -295,26 +183,8 @@ build:
         - name: SHA
           gitCommit:
             variant: Tags
-  cluster:
+  local:
+    useDockerCLI: true
+    useBuildkit: true
     concurrency: 0
-    randomDockerConfigSecret: false
-    randomPullSecret: false
-    dockerConfig:
-      secretName: hub-pingcap-net-ee
-    resources:
-      requests:
-        cpu: "1"
-        memory: 2Gi
-      limits:
-        cpu: "2"
-        memory: 4Gi
-profiles:
-  - name: local-docker
-    build:
-      local:
-        useDockerCLI: true
-        useBuildkit: true
-        concurrency: 0
-        tryImportMissing: true
-    patches:
-      - { op: move, from: /build/artifacts/0/kaniko, path: /build/artifacts/0/docker }
+    tryImportMissing: true
diff --git a/dockerfiles/cd/builders/tidb-dashboard/centos7/Dockerfile b/dockerfiles/cd/builders/tidb-dashboard/centos7/Dockerfile
new file mode 100644
index 00000000..5b9b6f19
--- /dev/null
+++ b/dockerfiles/cd/builders/tidb-dashboard/centos7/Dockerfile
@@ -0,0 +1,51 @@
+# build requires:
+#   - docker >= v20.10
+#
+# build steps:
+#   - git clone https://github.com/pingcap/tidb.git tidb
+#   - rm tidb/.dockerignore # make step depended on git metadata.
+#   - docker build -t tidb -f Dockerfile ./tidb
+
+########### stage: Builder
+FROM centos:7.9.2009 as builder
+# CentOS 7 has reached EOL
+RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
+
+# install packages.
+RUN yum -y update && \
+    yum -y groupinstall "Development Tools" && \
+    yum -y install java-11-openjdk && \
+    yum clean all
+
+# install golang toolchain
+# renovate: datasource=docker depName=golang
+ARG GOLANG_VERSION=1.21.13
+RUN OS=linux; ARCH=$([ "$(arch)" = "x86_64" ] && echo amd64 || echo arm64); \
+    curl -fsSL https://dl.google.com/go/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz | tar -C /usr/local -xz
+ENV PATH /usr/local/go/bin/:$PATH
+LABEL go-version="${GOLANG_VERSION}"
+
+# Install nodejs.
+RUN curl -fsSL https://rpm.nodesource.com/setup_16.x | bash -
+RUN yum -y install nodejs && yum clean all
+RUN npm install -g pnpm@7.30.5
+
+########### stage: Buiding
+FROM builder as building
+COPY . /ws
+ARG GOPROXY
+RUN GOPROXY=${GOPROXY} make package -C /ws
+RUN /ws/bin/tidb-dashboard --version
+
+########### stage: Final image
+FROM ghcr.io/pingcap-qe/bases/pd-base:v1.9.1
+
+COPY --from=building /ws/bin/tidb-dashboard /tidb-dashboard
+
+EXPOSE 12333
+ENTRYPOINT ["/tidb-dashboard"]
+
+# test it
+RUN /tidb-dashboard --version
diff --git a/dockerfiles/cd/builders/tidb/centos7/Dockerfile b/dockerfiles/cd/builders/tidb/centos7/Dockerfile
new file mode 100644
index 00000000..a1db09ac
--- /dev/null
+++ b/dockerfiles/cd/builders/tidb/centos7/Dockerfile
@@ -0,0 +1,48 @@
+# build requires:
+#   - docker >= v20.10
+#
+# build steps:
+#   - git clone https://github.com/pingcap/tidb.git tidb
+#   - rm tidb/.dockerignore # make step depended on git metadata.
+#   - docker build -t tidb -f Dockerfile ./tidb
+
+########### stage: Builder
+FROM centos:7.9.2009 as builder
+# CentOS 7 has reached EOL
+RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
+
+# install packages.
+RUN yum update --nogpgcheck -y && \
+    yum install --nogpgcheck -y epel-release deltarpm && \
+    yum update --nogpgcheck -y && \
+    yum groupinstall --nogpgcheck -y "Development Tools" && \
+    yum clean all
+
+# install golang toolchain
+# renovate: datasource=docker depName=golang
+ARG GOLANG_VERSION=1.21.13
+RUN OS=linux; ARCH=$([ "$(arch)" = "x86_64" ] && echo amd64 || echo arm64); \
+    curl -fsSL https://dl.google.com/go/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz | tar -C /usr/local -xz
+ENV PATH /usr/local/go/bin/:$PATH
+LABEL go-version="${GOLANG_VERSION}"
+
+########### stage: Buiding
+FROM builder as building
+COPY . /tidb
+ARG GOPROXY
+RUN GOPROXY=${GOPROXY} make server -C /tidb
+RUN /tidb/bin/tidb-server -V
+
+########### stage: Final image
+FROM ghcr.io/pingcap-qe/bases/tidb-base:v1.9.1
+
+COPY --from=building /tidb/bin/tidb-server /tidb-server
+
+WORKDIR /
+EXPOSE 4000
+ENTRYPOINT ["/tidb-server"]
+
+# test it
+RUN /tidb-server -V
diff --git a/dockerfiles/cd/builders/tiflash/centos7/Dockerfile b/dockerfiles/cd/builders/tiflash/centos7/Dockerfile
new file mode 100644
index 00000000..19a80e39
--- /dev/null
+++ b/dockerfiles/cd/builders/tiflash/centos7/Dockerfile
@@ -0,0 +1,52 @@
+# build requires:
+#   - docker >= v20.10
+#
+# build steps:
+#   - git clone --recurse-submodules https://github.com/tikv/tikv.git tikv
+#   - docker build -t tikv -f Dockerfile ./tikv
+
+########### stage: Builder
+FROM centos:7.9.2009 as builder
+# CentOS 7 has reached EOL
+RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
+
+LABEL org.opencontainers.image.authors "wuhui.zuo@pingcap.com"
+LABEL org.opencontainers.image.description "binary builder for tiflash"
+LABEL org.opencontainers.image.source = "https://github.com/PingCAP-QE/artifacts"
+
+# renovate: datasource=github-tags depName=pingcap/tiflash
+ARG TIFLASH_VER=v8.3.0
+RUN FILE=$([ "$(arch)" = "aarch64" ] && echo "bake_llvm_base_aarch64.sh" || echo "bake_llvm_base_amd64.sh"); \
+    TAR_DIR="tiflash-$(echo $TIFLASH_VER | sed 's/v//')"; \
+    curl -sSL https://github.com/pingcap/tiflash/archive/refs/tags/${TIFLASH_VER}.tar.gz -o tiflash.tar.gz && \
+    tar -zxf tiflash.tar.gz "$TAR_DIR/release-centos7-llvm/dockerfiles/misc" && \
+    pushd "$TAR_DIR/release-centos7-llvm/dockerfiles/misc" && \
+    chmod +x * && ./${FILE} && \
+    popd && \
+    rm -rf tiflash.tar.gz "$TAR_DIR"
+
+ENV PATH="/opt/cmake/bin:${PATH}:/usr/local/go/bin:/root/.cargo/bin"
+ENV CC=clang
+ENV CXX=clang++
+ENV LD=ld.lld
+
+########### stage: Buiding
+FROM builder as building
+
+ADD . /tiflash
+RUN /tiflash/release-centos7-llvm/scripts/build-release.sh
+RUN mkdir output && mv release-centos7-llvm/tiflash output/tiflash
+RUN output/tiflash/tiflash version
+
+########### stage: Final image
+FROM ghcr.io/pingcap-qe/bases/tiflash-base:v1.9.1
+
+ENV LD_LIBRARY_PATH /tiflash
+COPY --from=building /tiflash/output/tiflash /tiflash
+
+ENTRYPOINT ["/tiflash/tiflash", "server"]
+
+# test it
+RUN /tiflash/tiflash version
diff --git a/dockerfiles/cd/builders/tiflow/centos7/Dockerfile b/dockerfiles/cd/builders/tiflow/centos7/Dockerfile
new file mode 100644
index 00000000..744efeb8
--- /dev/null
+++ b/dockerfiles/cd/builders/tiflow/centos7/Dockerfile
@@ -0,0 +1,95 @@
+# build requires:
+#   - docker >= v20.10
+#
+# build steps:
+#   - git clone --recurse-submodules https://github.com/pingcap/tiflow.git tiflow
+#   - docker build -t dm -f Dockerfile ./tiflow
+
+########### stage: Builder - cdc
+FROM centos:7.9.2009 as builder-cdc
+# CentOS 7 has reached EOL
+RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
+
+# install packages.
+RUN yum update --nogpgcheck -y && \
+    yum install --nogpgcheck -y epel-release deltarpm && \
+    yum update --nogpgcheck -y && \
+    yum groupinstall --nogpgcheck -y "Development Tools" && \
+    yum clean all
+
+# install golang toolchain
+# renovate: datasource=docker depName=golang
+ARG GOLANG_VERSION=1.21.13
+RUN OS=linux; ARCH=$([ "$(arch)" = "x86_64" ] && echo amd64 || echo arm64); \
+    curl -fsSL https://dl.google.com/go/go${GOLANG_VERSION}.linux-${ARCH}.tar.gz | tar -C /usr/local -xz
+ENV PATH /usr/local/go/bin/:$PATH
+LABEL go-version="${GOLANG_VERSION}"
+
+########### stage: Builder - dm
+FROM builder-cdc as builder-dm
+
+# install nodejs toolchain
+# renovate: datasource=docker depName=node
+ARG NODE_VERSION=16.20.2
+# renovate: datasource=github-releases depName=nvm-sh/nvm
+ARG NVM_VERSION=v0.40.1
+ARG NVM_DIR=/usr/local/nvm
+RUN mkdir -p $NVM_DIR && \
+    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh | bash && \
+    . $NVM_DIR/nvm.sh && \
+    nvm install ${NODE_VERSION} && \
+    nvm use v${NODE_VERSION} && \
+    nvm alias default v${NODE_VERSION}
+ENV PATH="${NVM_DIR}/versions/node/v${NODE_VERSION}/bin/:${PATH}"
+RUN node --version && npm --version && npm install -g yarn
+
+########### stage: Builder - total
+FROM builder-dm as builder
+
+########### stage: Buiding cdc
+FROM builder-cdc as building-cdc
+
+COPY . /tiflow
+ARG GOPROXY
+RUN GOPROXY=${GOPROXY} make cdc -C /tiflow
+RUN /tiflow/bin/cdc version
+
+########### stage: Buiding dm
+FROM builder-dm as building-dm
+
+COPY . /tiflow
+ARG GOPROXY
+RUN GOPROXY=${GOPROXY} make dm-master-with-webui dm-worker dmctl dm-syncer -C /tiflow
+RUN /tiflow/bin/dm-master -V
+RUN /tiflow/bin/dm-worker -V
+RUN /tiflow/bin/dm-syncer -V
+RUN /tiflow/bin/dmctl -V
+
+########### stage: Final image - cdc
+FROM ghcr.io/pingcap-qe/bases/tools-base:v1.9.1 as final-cdc
+
+COPY --from=building-cdc /tiflow/bin/cdc /cdc
+EXPOSE 8300
+CMD ["/cdc"]
+
+# test it
+RUN /cdc version
+
+
+########### stage: Final image - dm
+FROM ghcr.io/pingcap-qe/bases/tools-base:v1.9.1 as final-dm
+
+COPY --from=building-dm /tiflow/bin/dm-master /dm-master
+COPY --from=building-dm /tiflow/bin/dm-worker /dm-worker
+COPY --from=building-dm /tiflow/bin/dm-syncer /dm-syncer
+COPY --from=building-dm /tiflow/bin/dmctl     /dmctl
+
+EXPOSE 8291 8261 8262
+
+# test it
+RUN /dm-master -V
+RUN /dm-worker -V
+RUN /dm-syncer -V
+RUN /dmctl -V
diff --git a/dockerfiles/cd/builders/tikv/centos7/Dockerfile b/dockerfiles/cd/builders/tikv/centos7/Dockerfile
new file mode 100644
index 00000000..53a58bad
--- /dev/null
+++ b/dockerfiles/cd/builders/tikv/centos7/Dockerfile
@@ -0,0 +1,59 @@
+# build requires:
+#   - docker >= v20.10
+#
+# build steps:
+#   - git clone --recurse-submodules https://github.com/tikv/tikv.git tikv
+#   - docker build -t tikv -f Dockerfile ./tikv
+
+########### stage: Builder
+FROM centos:7.9.2009 as builder
+# CentOS 7 has reached EOL
+RUN sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo \
+    && sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo
+
+# install packages.
+ARG DEVTOOLSET_VER=8
+RUN yum install --nogpgcheck -y epel-release centos-release-scl deltarpm && \
+    sed -i s/mirror.centos.org/vault.centos.org/g /etc/yum.repos.d/*.repo && \
+    sed -i s/^#.*baseurl=http/baseurl=http/g /etc/yum.repos.d/*.repo && \
+    sed -i s/^mirrorlist=http/#mirrorlist=http/g /etc/yum.repos.d/*.repo && \
+    ([ "$(arch)" = "x86_64" ] || sed -i s#vault.centos.org/centos/7/sclo/#vault.centos.org/altarch/7/sclo/#g /etc/yum.repos.d/*.repo) && \
+    yum update --nogpgcheck -y && \
+    yum install -y git devtoolset-${DEVTOOLSET_VER} perl cmake3 unzip && \
+    yum clean all && \
+    ln -s /usr/bin/cmake3 /usr/bin/cmake
+ENV DEVTOOLSET_VER ${DEVTOOLSET_VER}
+
+# install protoc.
+# renovate: datasource=github-release depName=protocolbuffers/protobuf
+ARG PROTOBUF_VER=v3.15.8
+RUN FILE=$([ "$(arch)" = "aarch64" ] && echo "protoc-${PROTOBUF_VER#?}-linux-aarch_64.zip" || echo "protoc-${PROTOBUF_VER#?}-linux-$(arch).zip"); \
+    curl -LO "https://github.com/protocolbuffers/protobuf/releases/download/${PROTOBUF_VER}/${FILE}" && unzip "$FILE" -d /usr/local/ && rm -f "$FILE"
+
+# install rust toolchain
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s - -y --default-toolchain none
+ENV PATH /root/.cargo/bin/:$PATH
+LABEL devtoolset-ver="${DEVTOOLSET_VER}"
+
+########### stage: Buiding
+FROM builder as building
+COPY . /tikv
+RUN --mount=type=cache,target=/tikv/target \
+    source /opt/rh/devtoolset-${DEVTOOLSET_VER}/enable && \
+    ROCKSDB_SYS_STATIC=1 \
+    make dist_release -C /tikv
+RUN /tikv/bin/tikv-server --version
+
+########### stage: Final image
+FROM ghcr.io/pingcap-qe/bases/tikv-base:v1.9.1
+
+ENV MALLOC_CONF="prof:true,prof_active:false"
+COPY --from=building /tikv/bin/tikv-server  /tikv-server
+COPY --from=building /tikv/bin/tikv-ctl     /tikv-ctl
+
+EXPOSE 20160
+ENTRYPOINT ["/tikv-server"]
+
+# test it
+RUN /tikv-server --version