diff --git a/.github/workflows/repo.yml b/.github/workflows/repo.yml
index 856b5f66..bd52881d 100644
--- a/.github/workflows/repo.yml
+++ b/.github/workflows/repo.yml
@@ -9,12 +9,12 @@ jobs:
   pre-commit-autoupdate:
     name: pre-commit autoupdate
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/commaai/panda:latest
     steps:
     - uses: actions/checkout@v4
+    - run: ./setup.sh
     - name: pre-commit autoupdate
       run: |
+        source .venv/bin/activate
         git config --global --add safe.directory '*'
         pre-commit autoupdate
     - name: Create Pull Request
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index d5992976..4c988532 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -11,39 +11,16 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  RUN: docker run -v ${{ github.workspace }}:/tmp/pythonpath/panda -w /tmp/pythonpath/panda --rm panda /bin/bash -c
-  BUILD: |
-      export DOCKER_BUILDKIT=1
-      docker build --pull --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ghcr.io/commaai/panda:latest -t panda -f Dockerfile .
-
-  PYTHONWARNINGS: "error"
+  RUN: source .venv/bin/activate && /bin/bash -c
 
 jobs:
-  docker_push:
-    name: docker push
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && github.repository == 'commaai/panda'
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build Docker image
-        timeout-minutes: 11
-        run: eval "$BUILD"
-      - name: Login to dockerhub
-        run: docker login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
-      - name: Tag image
-        run: docker tag panda ghcr.io/commaai/panda:latest
-      - name: Push image
-        run: docker push ghcr.io/commaai/panda:latest
-
   build:
     name: build
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - run: ./setup.sh
       - name: Test python package installer
         run: ${{ env.RUN }} "pip install --break-system-packages .[dev]"
       - name: Build panda images and bootstub
@@ -60,11 +37,10 @@ jobs:
   unit_tests:
     name: unit tests
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - run: ./setup.sh
       - name: Build panda
         run: $RUN "scons -j4"
       - name: Test communication protocols
@@ -73,25 +49,35 @@ jobs:
   misra_linter:
     name: MISRA C:2012 Linter
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - name: Cache cppcheck
+        id: cppcheck-cache
+        uses: actions/cache@v4
+        with:
+          path: tests/misra/cppcheck
+          key: cppcheck-${{ hashFiles('tests/misra/*') }}
+      - run: ./setup.sh
       - name: Build FW
         run: ${{ env.RUN }} "scons -j$(nproc)"
       - name: Run MISRA C:2012 analysis
-        timeout-minutes: 2
+        timeout-minutes: 4
         run: ${{ env.RUN }} "cd tests/misra && ./test_misra.sh"
 
   misra_mutation:
     name: MISRA C:2012 Mutation
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - name: Cache cppcheck
+        id: cppcheck-cache
+        uses: actions/cache@v4
+        with:
+          path: tests/misra/cppcheck
+          key: cppcheck-${{ hashFiles('tests/misra/*') }}
+      - run: ./setup.sh
       - name: Build FW
         run: ${{ env.RUN }} "scons -j$(nproc)"
       - name: MISRA mutation tests
@@ -101,11 +87,10 @@ jobs:
   static_analysis:
     name: static analysis
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
-      - name: Build Docker image
-        run: eval "$BUILD"
+      - run: ./setup.sh
       - name: Run static analysis
         timeout-minutes: 3
         run: ${{ env.RUN }} "pre-commit run --all"
diff --git a/Dockerfile b/Dockerfile
index 5b91a473..88190b08 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,23 +3,11 @@ FROM ubuntu:24.04
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONPATH=/tmp/pythonpath
 
+# deps install
+COPY pyproject.toml __init__.py setup.sh /tmp/
+COPY python/__init__.py /tmp/python/
 ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    make \
-    g++ \
-    gcc-arm-none-eabi libnewlib-arm-none-eabi \
-    git \
-    libffi-dev \
-    libusb-1.0-0 \
-    python3-dev \
-    python3-pip \
- && rm -rf /var/lib/apt/lists/* && \
-    apt clean
-
-ENV CPPCHECK_DIR=/tmp/cppcheck
-COPY tests/misra/install.sh /tmp/
-RUN /tmp/install.sh && rm -rf $CPPCHECK_DIR/.git/
-ENV SKIP_CPPCHECK_INSTALL=1
+RUN apt-get update && apt-get install -y --no-install-recommends sudo && /tmp/setup.sh
 
 COPY pyproject.toml __init__.py $PYTHONPATH/panda/
 COPY python/__init__.py $PYTHONPATH/panda/python/
diff --git a/setup.sh b/setup.sh
index d07502d8..6ad49127 100755
--- a/setup.sh
+++ b/setup.sh
@@ -13,7 +13,8 @@ if [[ $PLATFORM == "Darwin" ]]; then
 elif [[ $PLATFORM == "Linux" ]]; then
   sudo apt-get install -y --no-install-recommends \
     make g++ git libnewlib-arm-none-eabi \
-    gcc-arm-none-eabi python3-pip
+    libusb-1.0-0 \
+    gcc-arm-none-eabi python3-pip python3-venv python3-dev
 else
   echo "WARNING: unsupported platform. skipping apt/brew install."
 fi