diff --git a/BUILD.bazel b/BUILD.bazel
index c62f253d6..aa49ac264 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -25,16 +25,18 @@ genrule(
 container_bundle(
     name = "images",
     images = {
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//build:controller.image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//build:acmesolver.image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//build:webhook.image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//build:cainjector.image",
     },
+    tags = ["manual"],
 )
 
 docker_push(
     name = "images.push",
     bundle = ":images",
+    tags = ["manual"],
 )
 
 filegroup(
diff --git a/build/BUILD.bazel b/build/BUILD.bazel
index c908a5237..9cc5e3b4c 100644
--- a/build/BUILD.bazel
+++ b/build/BUILD.bazel
@@ -44,6 +44,7 @@ DOCKERIZED_BINARIES = {
         "/usr/local/bin/" + binary: "/usr/bin/" + binary,
     },
     tags = ["manual"],
+    user = "1000",
     visibility = ["//visibility:private"],
 ) for binary, meta in DOCKERIZED_BINARIES.items()]
 
diff --git a/build/container.bzl b/build/container.bzl
index 4bd0fb8a8..5b62ce533 100644
--- a/build/container.bzl
+++ b/build/container.bzl
@@ -66,18 +66,18 @@ def multi_arch_container(
     )
 
     container_image(
-        name = "%s-internal" % name,
+        name = "%s.image" % name,
         base = ":%s-internal-notimestamp" % name,
         stamp = stamp,
         tags = tags,
-        visibility = ["//visibility:private"],
+        visibility = ["//visibility:public"],
     )
 
     for arch in architectures:
         container_bundle(
             name = "%s-%s" % (name, arch),
             images = {
-                docker_tag.format(ARCH = arch): ":%s-internal" % name
+                docker_tag.format(ARCH = arch): ":%s.image" % name
                 for docker_tag in docker_tags
             },
             tags = tags,
@@ -107,7 +107,7 @@ def multi_arch_container(
         multi_arch_container_push(
             name = name,
             architectures = architectures,
-            docker_tags_images = {docker_push_tag: ":%s-internal" % name for docker_push_tag in docker_push_tags},
+            docker_tags_images = {docker_push_tag: ":%s.image" % name for docker_push_tag in docker_push_tags},
             tags = tags,
         )
 
diff --git a/cmd/acmesolver/BUILD.bazel b/cmd/acmesolver/BUILD.bazel
index 411723056..1dbf3296d 100644
--- a/cmd/acmesolver/BUILD.bazel
+++ b/cmd/acmesolver/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":acmesolver",
-    component = "acmesolver",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "acmesolver",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = ["main.go"],
diff --git a/cmd/cainjector/BUILD.bazel b/cmd/cainjector/BUILD.bazel
index 60a897601..ec5e90838 100644
--- a/cmd/cainjector/BUILD.bazel
+++ b/cmd/cainjector/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":cainjector",
-    component = "cainjector",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "cainjector",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = [
diff --git a/cmd/controller/BUILD.bazel b/cmd/controller/BUILD.bazel
index a838a3c29..085ab85ec 100644
--- a/cmd/controller/BUILD.bazel
+++ b/cmd/controller/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":controller",
-    component = "controller",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "controller",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = [
diff --git a/cmd/webhook/BUILD.bazel b/cmd/webhook/BUILD.bazel
index 97d43e060..95148a8a9 100644
--- a/cmd/webhook/BUILD.bazel
+++ b/cmd/webhook/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":webhook",
-    component = "webhook",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "webhook",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = ["main.go"],
diff --git a/devel/addon/certmanager/BUILD.bazel b/devel/addon/certmanager/BUILD.bazel
index 8749bb1b6..a732d441a 100644
--- a/devel/addon/certmanager/BUILD.bazel
+++ b/devel/addon/certmanager/BUILD.bazel
@@ -3,10 +3,10 @@ load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
 container_bundle(
     name = "bundle",
     images = {
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//build:controller.image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//build:acmesolver.image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//build:webhook.image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//build:cainjector.image",
     },
     tags = ["manual"],
 )
diff --git a/devel/addon/pebble/BUILD.bazel b/devel/addon/pebble/BUILD.bazel
index 0da887d61..a1337a6fe 100644
--- a/devel/addon/pebble/BUILD.bazel
+++ b/devel/addon/pebble/BUILD.bazel
@@ -16,6 +16,7 @@ go_image(
     name = "image",
     base = "@static_base//image",
     binary = ":app",
+    tags = ["manual"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/devel/addon/samplewebhook/sample/BUILD.bazel b/devel/addon/samplewebhook/sample/BUILD.bazel
index 49f1cf2a0..44049ddcf 100644
--- a/devel/addon/samplewebhook/sample/BUILD.bazel
+++ b/devel/addon/samplewebhook/sample/BUILD.bazel
@@ -5,6 +5,7 @@ go_image(
     name = "image",
     base = "@static_base//image",
     binary = ":sample",
+    tags = ["manual"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/hack/build/docker.bzl b/hack/build/docker.bzl
index ad4af395b..bb31ec73a 100644
--- a/hack/build/docker.bzl
+++ b/hack/build/docker.bzl
@@ -17,38 +17,6 @@ load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_go//go:def.bzl", "go_test")
 
-def image(
-    name,
-    component,
-    binary,
-    user = "1000",
-    stamp = True,
-    testonly = False,
-    **kwargs):
-
-    go_image(
-        name = "%s.app" % name,
-        base = "@static_base//image",
-        binary = binary,
-        testonly = testonly,
-    )
-
-    container_image(
-        name = name,
-        base = "%s.app" % name,
-        user = user,
-        stamp = stamp,
-        testonly = testonly,
-        **kwargs)
-
-    container_bundle(
-        name = name + ".export",
-        images = {
-            component + ":{STABLE_APP_GIT_COMMIT}": ":" + name,
-        },
-        testonly = testonly,
-    )
-
 def covered_image(name, component, **kwargs):
     native.genrule(
         name = "%s.covered-testfile" % name,
@@ -84,9 +52,23 @@ EOF
         tags = ["manual"],
     )
 
-    image(
-        name = name,
+    go_image(
+        name = "%s.covered-image" % name,
+        base = "@static_base//image",
         binary = "%s.covered-app" % name,
         testonly = True,
-        component = component,
+    )
+
+    container_image(
+        name = name,
+        base = "%s.covered-image" % name,
+        testonly = True,
         **kwargs)
+
+    container_bundle(
+        name = name + ".export",
+        images = {
+            component + ":{STABLE_APP_GIT_COMMIT}": ":" + name,
+        },
+        testonly = True,
+    )
diff --git a/test/e2e/BUILD.bazel b/test/e2e/BUILD.bazel
index 9fc53410f..ad29b8475 100644
--- a/test/e2e/BUILD.bazel
+++ b/test/e2e/BUILD.bazel
@@ -1,23 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
-load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
-
-container_bundle(
-    name = "images",
-    images = {
-        # A set of images to bundle up into a single tarball.
-        "pebble:bazel": "//test/e2e/charts/pebble:image",
-        "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1": "@io_kubernetes_ingress-nginx//image",
-        "k8s.gcr.io/defaultbackend-amd64:bazel": "@io_gcr_k8s_defaultbackend//image",
-        "vault:bazel": "@com_hashicorp_vault//image",
-        "sample-webhook:bazel": "//test/e2e/framework/addon/samplewebhook/sample:image",
-        "gcr.io/kubernetes-helm/tiller:bazel": "@io_gcr_helm_tiller//image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image",
-    },
-    tags = ["manual"],
-)
 
 # we add this rule so users can `bazel build //test/e2e` to run a
 # platform-independent version of the e2e test binary
@@ -73,7 +54,6 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//test/e2e/bin/cloudflare-clean:all-srcs",
-        "//test/e2e/charts:all-srcs",
         "//test/e2e/framework:all-srcs",
         "//test/e2e/suite:all-srcs",
         "//test/e2e/util:all-srcs",
diff --git a/test/e2e/charts/BUILD.bazel b/test/e2e/charts/BUILD.bazel
deleted file mode 100644
index 91c378fe9..000000000
--- a/test/e2e/charts/BUILD.bazel
+++ /dev/null
@@ -1,28 +0,0 @@
-load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
-
-container_bundle(
-    name = "images",
-    images = {
-        # A set of images to bundle up into a single tarball.
-        "pebble:bazel": "//test/e2e/charts/pebble:image",
-        "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1": "@io_kubernetes_ingress-nginx//image",
-        "k8s.gcr.io/defaultbackend-amd64:bazel": "@io_gcr_k8s_defaultbackend//image",
-        "vault:bazel": "@com_hashicorp_vault//image",
-        "gcr.io/kubernetes-helm/tiller:bazel": "@io_gcr_helm_tiller//image",
-    },
-    tags = ["manual"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)