diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 51b8364..e7fa4d8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -2,24 +2,43 @@ name: Tests
 
 on: [push, pull_request]
 
+env:
+  RUN: docker run --shm-size 1G --rm cereal /bin/sh -c
+  BUILD: |
+      docker pull $(grep -ioP '(?<=^from)\s+\S+' Dockerfile) || true
+      docker pull docker.io/commaai/cereal:latest || true
+      docker build --cache-from docker.io/commaai/cereal:latest -t cereal -f Dockerfile .
+
 jobs:
   test:
-
+    name: tests
     runs-on: ubuntu-16.04
-
     steps:
     - uses: actions/checkout@v2
     - name: Build docker image
-      run: docker build -t cereal .
-    - name: Static analysis
-      run: |
-        docker run cereal bash -c "git init && git add -A && pre-commit run --all"
+      run: eval "$BUILD"
     - name: Unit Tests
       run: |
-        docker run cereal bash -c "scons --test --asan -j$(nproc) && messaging/test_runner"
+        $RUN "scons --test --asan -j$(nproc) && messaging/test_runner"
     - name: Test ZMQ
       run: |
-        docker run cereal bash -c "ZMQ=1 python -m unittest discover ."
+        $RUN "ZMQ=1 python -m unittest discover ."
     - name: Test MSGQ
       run: |
-        docker run cereal bash -c "MSGQ=1 python -m unittest discover ."
+        $RUN "MSGQ=1 python -m unittest discover ."
+    - name: Push to dockerhub
+      run: |
+        docker login -u wmelching -p ${{ secrets.COMMA_DOCKERHUB_TOKEN}}
+        docker tag cereal docker.io/commaai/cereal:latest
+        docker push docker.io/commaai/cereal:latest
+
+  static_analysis:
+    name: static analysis
+    runs-on: ubuntu-16.04
+    steps:
+    - uses: actions/checkout@v2
+    - name: Build docker image
+      run: eval "$BUILD"
+    - name: Static analysis
+      run: |
+        $RUN "git init && git add -A && pre-commit run --all"
diff --git a/Dockerfile b/Dockerfile
index 93c64ee..4d1e329 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,15 +31,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 RUN curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
 ENV PATH="/root/.pyenv/bin:/root/.pyenv/shims:${PATH}"
-RUN pyenv install 3.7.3
-RUN pyenv global 3.7.3
-RUN pyenv rehash
-RUN pip3 install pyyaml==5.1.2 Cython==0.29.14 scons==3.1.1 pycapnp==0.6.4 pre-commit==2.4.0 pylint==2.5.2
+RUN pyenv install 3.7.3 && \
+    pyenv global 3.7.3 && \
+    pyenv rehash && \
+    pip3 install --no-cache-dir pyyaml==5.1.2 Cython==0.29.14 scons==3.1.1 pycapnp==0.6.4 pre-commit==2.4.0 pylint==2.5.2
 
 WORKDIR /project/cereal
 
 ENV PYTHONPATH=/project
 
 COPY . .
-RUN rm -rf .git
-RUN scons -c && scons -j$(nproc)
+RUN rm -rf .git && \
+    scons -c && scons -j$(nproc)