diff --git a/Makefile b/Makefile
index 33aeb0f5..e6f6c4fd 100644
--- a/Makefile
+++ b/Makefile
@@ -170,13 +170,10 @@ ifeq ($(PUBLISH), true)
 	@docker push $(DOCKER_IMAGE)
 endif
 
-# Use specific Dockerfile instead of general one to make image for kubeval-validator and toolbox
-docker-image-toolbox: DOCKER_CMD_FLAGS+=-f krm-functions/toolbox/Dockerfile
-docker-image-kubeval-validator: DOCKER_CMD_FLAGS+=-f krm-functions/kubeval-validator/image/Dockerfile
 .PHONY: $(PLUGINS_IMAGE_TGT)
 $(PLUGINS_IMAGE_TGT):
 	$(eval plugin_name=$(subst docker-image-,,$@))
-	@docker build . $(DOCKER_CMD_FLAGS) \
+	@docker build $(PLUGINS_DIR)/$(plugin_name) $(DOCKER_CMD_FLAGS) \
 		--label $(LABEL) \
 		--label "org.opencontainers.image.revision=$(COMMIT)" \
 		--label "org.opencontainers.image.created=$(shell date --rfc-3339=seconds --utc)" \
diff --git a/krm-functions/cloud-init/Dockerfile.sample b/krm-functions/cloud-init/Dockerfile
similarity index 81%
rename from krm-functions/cloud-init/Dockerfile.sample
rename to krm-functions/cloud-init/Dockerfile
index f05f6020..fbebac7f 100644
--- a/krm-functions/cloud-init/Dockerfile.sample
+++ b/krm-functions/cloud-init/Dockerfile
@@ -1,4 +1,6 @@
-FROM gcr.io/gcp-runtimes/go1-builder:1.15 as builder
+ARG GO_IMAGE=gcr.io/gcp-runtimes/go1-builder:1.15
+ARG PLUGINS_RELEASE_IMAGE=alpine:3.12.0
+FROM ${GO_IMAGE} as builder
 
 # Inject custom root certificate authorities if needed
 # Docker does not have a good conditional copy statement and requires that a source file exists
@@ -14,6 +16,6 @@ RUN /usr/local/go/bin/go mod download
 COPY main.go .
 RUN /usr/local/go/bin/go build -v -o /usr/local/bin/config-function ./
 
-FROM alpine:latest
+FROM ${PLUGINS_RELEASE_IMAGE} as release
 COPY --from=builder /usr/local/bin/config-function /usr/local/bin/config-function
 CMD ["/usr/local/bin/config-function"]
diff --git a/krm-functions/cloud-init/Makefile b/krm-functions/cloud-init/Makefile
index 7427cad6..a5566350 100644
--- a/krm-functions/cloud-init/Makefile
+++ b/krm-functions/cloud-init/Makefile
@@ -19,45 +19,44 @@ USE_PROXY           ?= false
 
 .PHONY: build
 build:
-	(cd image && go build -v -o $(GOBIN)/config-function .)
+	(go build -v -o $(GOBIN)/config-function .)
 
 .PHONY: all
 all: generate license build fix vet fmt test lint tidy
 
 .PHONY: fix
 fix:
-	(cd image && go fix ./...)
+	(go fix .)
 
 .PHONY: fmt
 fmt:
-	(cd image && go fmt ./...)
+	(go fmt .)
 
 .PHONY: generate
 generate:
 	(which $(GOBIN)/mdtogo || go get sigs.k8s.io/kustomize/cmd/mdtogo)
-	(cd image && GOBIN=$(GOBIN) go generate ./...)
+	(GOBIN=$(GOBIN) go generate .)
 
 .PHONY: tidy
 tidy:
-	(cd image && go mod tidy)
+	(go mod tidy)
 
 .PHONY: fix
 lint:
 	(which $(GOBIN)/golangci-lint || go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.19.1)
-	(cd image && $(GOBIN)/golangci-lint run ./...)
+	($(GOBIN)/golangci-lint run .)
 
 .PHONY: test
 test:
-	(cd image && go test -cover ./...)
+	(go test -cover .)
 
 .PHONY: vet
 vet:
-	(cd image && go vet ./...)
+	(go vet .)
 
 .PHONY: image
 image:
 ifeq ($(USE_PROXY), true)
-	cd image && \
 	docker build . --network=host \
 		--build-arg http_proxy=$(PROXY) \
 		--build-arg https_proxy=$(PROXY) \
@@ -68,7 +67,6 @@ ifeq ($(USE_PROXY), true)
 	  --tag $(DOCKER_IMAGE) \
 	  --force-rm=$(DOCKER_FORCE_CLEAN)
 else
-	cd image && \
 	docker build . --network=host \
 	    --tag $(DOCKER_IMAGE) \
 	    --force-rm=$(DOCKER_FORCE_CLEAN)
diff --git a/krm-functions/cloud-init/certs/README.md b/krm-functions/cloud-init/certs/README.md
new file mode 100755
index 00000000..7d04f7ec
--- /dev/null
+++ b/krm-functions/cloud-init/certs/README.md
@@ -0,0 +1,6 @@
+# Additional Docker image root certificate authorities
+If you require additional certificate authorities for your Docker image:
+* Add ASCII PEM encoded .crt files to this directory
+  * The files will be copied into your docker image at build time.
+
+To update manually copy the .crt files to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates.
\ No newline at end of file
diff --git a/krm-functions/cloud-init/image/go.mod b/krm-functions/cloud-init/image/go.mod
index a30c7a94..867a7107 100644
--- a/krm-functions/cloud-init/image/go.mod
+++ b/krm-functions/cloud-init/image/go.mod
@@ -3,7 +3,7 @@ module opendev.org/airship/airshipctl/functions/cloud-init/image
 go 1.14
 
 require (
-	opendev.org/airship/airshipctl v0.0.0-20210217205206-b8a4b6ad734c
+	opendev.org/airship/airshipctl v0.0.0-20210421143147-014e24cd1591
 	sigs.k8s.io/kustomize/kyaml v0.10.0
 	sigs.k8s.io/kustomize/api v0.7.2
 )
diff --git a/krm-functions/kubeval-validator/image/Dockerfile b/krm-functions/kubeval-validator/Dockerfile
similarity index 79%
rename from krm-functions/kubeval-validator/image/Dockerfile
rename to krm-functions/kubeval-validator/Dockerfile
index 6ccb0e35..8bbd659c 100644
--- a/krm-functions/kubeval-validator/image/Dockerfile
+++ b/krm-functions/kubeval-validator/Dockerfile
@@ -4,10 +4,10 @@ FROM ${GO_IMAGE} as function
 ENV PATH "/usr/local/go/bin:$PATH"
 ENV CGO_ENABLED=0
 WORKDIR /go/src/
-COPY krm-functions/kubeval-validator/image/go.mod .
-COPY krm-functions/kubeval-validator/image/go.sum .
+COPY image/go.mod .
+COPY image/go.sum .
 RUN go mod download
-COPY krm-functions/kubeval-validator/image/main.go .
+COPY image/main.go .
 RUN go build -v -o /usr/local/bin/config-function ./
 
 FROM ${PLUGINS_RELEASE_IMAGE} as release
@@ -24,5 +24,5 @@ RUN echo "**** install Python ****" && \
 
 RUN pip3 install 'ruamel.yaml==0.16.13' 'openapi2jsonschema==0.9.0' openapi-spec-validator
 COPY --from=function /usr/local/bin/config-function /usr/local/bin/config-function
-COPY krm-functions/kubeval-validator/image/extract-openapi.py /usr/local/bin/
+COPY image/extract-openapi.py /usr/local/bin/
 CMD ["config-function"]
diff --git a/krm-functions/replacement-transformer/Dockerfile.sample b/krm-functions/replacement-transformer/Dockerfile
similarity index 81%
rename from krm-functions/replacement-transformer/Dockerfile.sample
rename to krm-functions/replacement-transformer/Dockerfile
index f05f6020..fbebac7f 100644
--- a/krm-functions/replacement-transformer/Dockerfile.sample
+++ b/krm-functions/replacement-transformer/Dockerfile
@@ -1,4 +1,6 @@
-FROM gcr.io/gcp-runtimes/go1-builder:1.15 as builder
+ARG GO_IMAGE=gcr.io/gcp-runtimes/go1-builder:1.15
+ARG PLUGINS_RELEASE_IMAGE=alpine:3.12.0
+FROM ${GO_IMAGE} as builder
 
 # Inject custom root certificate authorities if needed
 # Docker does not have a good conditional copy statement and requires that a source file exists
@@ -14,6 +16,6 @@ RUN /usr/local/go/bin/go mod download
 COPY main.go .
 RUN /usr/local/go/bin/go build -v -o /usr/local/bin/config-function ./
 
-FROM alpine:latest
+FROM ${PLUGINS_RELEASE_IMAGE} as release
 COPY --from=builder /usr/local/bin/config-function /usr/local/bin/config-function
 CMD ["/usr/local/bin/config-function"]
diff --git a/krm-functions/replacement-transformer/Makefile b/krm-functions/replacement-transformer/Makefile
index d62b9ebe..fe762f7b 100644
--- a/krm-functions/replacement-transformer/Makefile
+++ b/krm-functions/replacement-transformer/Makefile
@@ -19,45 +19,44 @@ USE_PROXY           ?= false
 
 .PHONY: build
 build:
-	(cd image && go build -v -o $(GOBIN)/config-function .)
+	(go build -v -o $(GOBIN)/config-function .)
 
 .PHONY: all
 all: generate license build fix vet fmt test lint tidy
 
 .PHONY: fix
 fix:
-	(cd image && go fix ./...)
+	(go fix .)
 
 .PHONY: fmt
 fmt:
-	(cd image && go fmt ./...)
+	(go fmt .)
 
 .PHONY: generate
 generate:
 	(which $(GOBIN)/mdtogo || go get sigs.k8s.io/kustomize/cmd/mdtogo)
-	(cd image && GOBIN=$(GOBIN) go generate ./...)
+	(GOBIN=$(GOBIN) go generate .)
 
 .PHONY: tidy
 tidy:
-	(cd image && go mod tidy)
+	(go mod tidy)
 
 .PHONY: fix
 lint:
 	(which $(GOBIN)/golangci-lint || go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.19.1)
-	(cd image && $(GOBIN)/golangci-lint run ./...)
+	($(GOBIN)/golangci-lint run .)
 
 .PHONY: test
 test:
-	(cd image && go test -cover ./...)
+	(go test -cover .)
 
 .PHONY: vet
 vet:
-	(cd image && go vet ./...)
+	(go vet .)
 
 .PHONY: image
 image:
 ifeq ($(USE_PROXY), true)
-	cd image && \
 	docker build . --network=host \
 		--build-arg http_proxy=$(PROXY) \
 		--build-arg https_proxy=$(PROXY) \
@@ -68,7 +67,6 @@ ifeq ($(USE_PROXY), true)
 	  --tag $(DOCKER_IMAGE) \
 	  --force-rm=$(DOCKER_FORCE_CLEAN)
 else
-	cd image && \
 	docker build . --network=host \
 	    --tag $(DOCKER_IMAGE) \
 	    --force-rm=$(DOCKER_FORCE_CLEAN)
diff --git a/krm-functions/replacement-transformer/certs/README.md b/krm-functions/replacement-transformer/certs/README.md
new file mode 100755
index 00000000..7d04f7ec
--- /dev/null
+++ b/krm-functions/replacement-transformer/certs/README.md
@@ -0,0 +1,6 @@
+# Additional Docker image root certificate authorities
+If you require additional certificate authorities for your Docker image:
+* Add ASCII PEM encoded .crt files to this directory
+  * The files will be copied into your docker image at build time.
+
+To update manually copy the .crt files to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates.
\ No newline at end of file
diff --git a/krm-functions/replacement-transformer/image/go.mod b/krm-functions/replacement-transformer/image/go.mod
index 3520e46a..a822c19f 100644
--- a/krm-functions/replacement-transformer/image/go.mod
+++ b/krm-functions/replacement-transformer/image/go.mod
@@ -3,6 +3,6 @@ module opendev.org/airship/airshipctl/functions/replacement-transformer/image
 go 1.14
 
 require (
-	opendev.org/airship/airshipctl v0.0.0-20201007215749-76e4d3f48c5a
+	opendev.org/airship/airshipctl v0.0.0-20210421143147-014e24cd1591
 	sigs.k8s.io/kustomize/kyaml v0.7.1
 )
diff --git a/krm-functions/templater/Dockerfile.sample b/krm-functions/templater/Dockerfile
similarity index 81%
rename from krm-functions/templater/Dockerfile.sample
rename to krm-functions/templater/Dockerfile
index f05f6020..fbebac7f 100644
--- a/krm-functions/templater/Dockerfile.sample
+++ b/krm-functions/templater/Dockerfile
@@ -1,4 +1,6 @@
-FROM gcr.io/gcp-runtimes/go1-builder:1.15 as builder
+ARG GO_IMAGE=gcr.io/gcp-runtimes/go1-builder:1.15
+ARG PLUGINS_RELEASE_IMAGE=alpine:3.12.0
+FROM ${GO_IMAGE} as builder
 
 # Inject custom root certificate authorities if needed
 # Docker does not have a good conditional copy statement and requires that a source file exists
@@ -14,6 +16,6 @@ RUN /usr/local/go/bin/go mod download
 COPY main.go .
 RUN /usr/local/go/bin/go build -v -o /usr/local/bin/config-function ./
 
-FROM alpine:latest
+FROM ${PLUGINS_RELEASE_IMAGE} as release
 COPY --from=builder /usr/local/bin/config-function /usr/local/bin/config-function
 CMD ["/usr/local/bin/config-function"]
diff --git a/krm-functions/templater/Makefile b/krm-functions/templater/Makefile
index de034b15..5546f1d6 100644
--- a/krm-functions/templater/Makefile
+++ b/krm-functions/templater/Makefile
@@ -19,45 +19,44 @@ USE_PROXY           ?= false
 
 .PHONY: build
 build:
-	(cd image && go build -v -o $(GOBIN)/config-function .)
+	(go build -v -o $(GOBIN)/config-function .)
 
 .PHONY: all
 all: generate license build fix vet fmt test lint tidy
 
 .PHONY: fix
 fix:
-	(cd image && go fix ./...)
+	(go fix .)
 
 .PHONY: fmt
 fmt:
-	(cd image && go fmt ./...)
+	(go fmt .)
 
 .PHONY: generate
 generate:
 	(which $(GOBIN)/mdtogo || go get sigs.k8s.io/kustomize/cmd/mdtogo)
-	(cd image && GOBIN=$(GOBIN) go generate ./...)
+	(GOBIN=$(GOBIN) go generate .)
 
 .PHONY: tidy
 tidy:
-	(cd image && go mod tidy)
+	(go mod tidy)
 
 .PHONY: fix
 lint:
 	(which $(GOBIN)/golangci-lint || go get github.com/golangci/golangci-lint/cmd/golangci-lint@v1.19.1)
-	(cd image && $(GOBIN)/golangci-lint run ./...)
+	($(GOBIN)/golangci-lint run .)
 
 .PHONY: test
 test:
-	(cd image && go test -cover ./...)
+	(go test -cover .)
 
 .PHONY: vet
 vet:
-	(cd image && go vet ./...)
+	(go vet .)
 
 .PHONY: image
 image:
 ifeq ($(USE_PROXY), true)
-	cd image && \
 	docker build . --network=host \
 		--build-arg http_proxy=$(PROXY) \
 		--build-arg https_proxy=$(PROXY) \
@@ -68,7 +67,6 @@ ifeq ($(USE_PROXY), true)
 	  --tag $(DOCKER_IMAGE) \
 	  --force-rm=$(DOCKER_FORCE_CLEAN)
 else
-	cd image && \
 	docker build . --network=host \
 	    --tag $(DOCKER_IMAGE) \
 	    --force-rm=$(DOCKER_FORCE_CLEAN)
diff --git a/krm-functions/templater/certs/README.md b/krm-functions/templater/certs/README.md
new file mode 100755
index 00000000..7d04f7ec
--- /dev/null
+++ b/krm-functions/templater/certs/README.md
@@ -0,0 +1,6 @@
+# Additional Docker image root certificate authorities
+If you require additional certificate authorities for your Docker image:
+* Add ASCII PEM encoded .crt files to this directory
+  * The files will be copied into your docker image at build time.
+
+To update manually copy the .crt files to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates.
\ No newline at end of file
diff --git a/krm-functions/templater/image/go.mod b/krm-functions/templater/image/go.mod
index ece315d1..aebceac0 100644
--- a/krm-functions/templater/image/go.mod
+++ b/krm-functions/templater/image/go.mod
@@ -3,6 +3,6 @@ module opendev.org/airship/airshipctl/functions/templater/image
 go 1.14
 
 require (
-	opendev.org/airship/airshipctl v0.0.0-20201007215749-76e4d3f48c5a
+	opendev.org/airship/airshipctl v0.0.0-20210421143147-014e24cd1591
 	sigs.k8s.io/kustomize/kyaml v0.7.1
 )
diff --git a/krm-functions/toolbox/Dockerfile b/krm-functions/toolbox/Dockerfile
index 52c68aac..22fcca38 100644
--- a/krm-functions/toolbox/Dockerfile
+++ b/krm-functions/toolbox/Dockerfile
@@ -20,9 +20,9 @@ RUN chmod +x /kubectl /calicoctl
 FROM ${GO_IMAGE} as builder
 ENV CGO_ENABLED=0
 WORKDIR /go/src/
-COPY krm-functions/toolbox/image/go.mod .
+COPY image/go.mod .
 RUN /usr/local/go/bin/go mod download
-COPY krm-functions/toolbox/main.go .
+COPY main.go .
 RUN /usr/local/go/bin/go build -v -o /usr/local/bin/config-function ./
 
 FROM ${PLUGINS_RELEASE_IMAGE} as release
diff --git a/krm-functions/toolbox/certs/README.md b/krm-functions/toolbox/certs/README.md
new file mode 100755
index 00000000..7d04f7ec
--- /dev/null
+++ b/krm-functions/toolbox/certs/README.md
@@ -0,0 +1,6 @@
+# Additional Docker image root certificate authorities
+If you require additional certificate authorities for your Docker image:
+* Add ASCII PEM encoded .crt files to this directory
+  * The files will be copied into your docker image at build time.
+
+To update manually copy the .crt files to /usr/local/share/ca-certificates/ and run sudo update-ca-certificates.
\ No newline at end of file