diff --git a/Dockerfile b/Dockerfile
index 1a1325f..0ff383b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,21 +1,21 @@
 FROM jedisct1/alpine-runit:latest
 MAINTAINER Frank Denis
+SHELL ["/bin/sh", "-x", "-c"]
 ENV SERIAL 3
 
+ENV CFLAGS=-Ofast
 ENV BUILD_DEPS   make gcc musl-dev git libevent-dev expat-dev shadow autoconf file openssl-dev byacc linux-headers
 ENV RUNTIME_DEPS bash util-linux coreutils findutils grep openssl ldns ldns-tools libevent expat libexecinfo coreutils drill ca-certificates
 
-RUN set -x && \
-    apk --no-cache upgrade && apk add --no-cache $RUNTIME_DEPS && \
-    update-ca-certificates 2> /dev/null || true
+RUN apk --no-cache upgrade && apk add --no-cache $RUNTIME_DEPS
+RUN update-ca-certificates 2> /dev/null || true
 
 ENV UNBOUND_GIT_URL https://github.com/jedisct1/unbound.git
 ENV UNBOUND_GIT_REVISION 4edb15ba417c78710069a5be8be3a6b5d8bdba9c
 
-RUN set -x && \
-    apk add --no-cache $BUILD_DEPS && \
-    mkdir -p /tmp/src && \
-    cd /tmp/src && \
+WORKDIR /tmp
+
+RUN apk add --no-cache $BUILD_DEPS && \
     git clone --depth=1000 "$UNBOUND_GIT_URL" && \
     cd unbound && \
     git checkout "$UNBOUND_GIT_REVISION" && \
@@ -23,7 +23,7 @@ RUN set -x && \
     useradd -g _unbound -s /etc -d /dev/null _unbound && \
     ./configure --prefix=/opt/unbound --with-pthreads \
     --with-username=_unbound --with-libevent --enable-event-api && \
-    make -j$(getconf _NPROCESSORS_ONLN) install && \
+    make -j"$(getconf _NPROCESSORS_ONLN)" install && \
     mv /opt/unbound/etc/unbound/unbound.conf /opt/unbound/etc/unbound/unbound.conf.example && \
     apk del --purge $BUILD_DEPS && \
     rm -fr /opt/unbound/share/man && \
@@ -31,14 +31,11 @@ RUN set -x && \
 
 ENV LIBSODIUM_GIT_URL https://github.com/jedisct1/libsodium.git
 
-RUN set -x && \
-    apk add --no-cache $BUILD_DEPS && \
-    mkdir -p /tmp/src && \
-    cd /tmp/src && \
+RUN apk add --no-cache $BUILD_DEPS && \
     git clone --depth=1 --branch stable "$LIBSODIUM_GIT_URL" && \
     cd libsodium && \
-    env CFLAGS=-Ofast ./configure --disable-dependency-tracking && \
-    make -j$(getconf _NPROCESSORS_ONLN) check && make -j$(getconf _NPROCESSORS_ONLN) install && \
+    ./configure --disable-dependency-tracking && \
+    make -j"$(getconf _NPROCESSORS_ONLN)" check && make -j"$(getconf _NPROCESSORS_ONLN)" install && \
     ldconfig /usr/local/lib && \
     apk del --purge $BUILD_DEPS && \
     rm -fr /tmp/* /var/tmp/*
@@ -48,11 +45,8 @@ ENV DNSCRYPT_WRAPPER_GIT_BRANCH xchacha-stamps
 
 COPY queue.h /tmp
 
-RUN set -x && \
-    apk add --no-cache $BUILD_DEPS && \
-    mkdir -p /tmp/src && \
-    cd /tmp/src && \
-    git clone --depth=1 --branch=${DNSCRYPT_WRAPPER_GIT_BRANCH} ${DNSCRYPT_WRAPPER_GIT_URL} && \
+RUN apk add --no-cache $BUILD_DEPS && \
+    git clone --depth=1 --branch="${DNSCRYPT_WRAPPER_GIT_BRANCH}" "${DNSCRYPT_WRAPPER_GIT_URL}" && \
     cd dnscrypt-wrapper && \
     sed -i 's#<sys/queue.h>#"/tmp/queue.h"#' compat.h && \
     sed -i 's#HAVE_BACKTRACE#NO_BACKTRACE#' compat.h && \
@@ -61,15 +55,12 @@ RUN set -x && \
     useradd -g _dnscrypt-wrapper -s /etc -d /opt/dnscrypt-wrapper/empty _dnscrypt-wrapper && \
     groupadd _dnscrypt-signer && \
     useradd -g _dnscrypt-signer -G _dnscrypt-wrapper -s /etc -d /dev/null _dnscrypt-signer && \
-    make -j$(getconf _NPROCESSORS_ONLN) configure && \
-    env CFLAGS=-Ofast ./configure --prefix=/opt/dnscrypt-wrapper && \
-    make -j$(getconf _NPROCESSORS_ONLN) install && \
+    make -j"$(getconf _NPROCESSORS_ONLN)" configure && \
+    ./configure --prefix=/opt/dnscrypt-wrapper && \
+    make -j"$(getconf _NPROCESSORS_ONLN)" install && \
     apk del --purge $BUILD_DEPS && \
     rm -fr /tmp/* /var/tmp/*
 
-RUN set -x && \
-    echo rm -rf /tmp/* /var/tmp/* /usr/local/include
-
 RUN mkdir -p \
     /etc/service/unbound \
     /etc/service/watchdog