diff --git a/apt-sync/Dockerfile b/apt-sync/Dockerfile
index b54919a..038a41a 100644
--- a/apt-sync/Dockerfile
+++ b/apt-sync/Dockerfile
@@ -1,7 +1,10 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="iBug <docker@ibugone.com>"
 LABEL bind_support=true
-RUN apk add --no-cache --update wget perl ca-certificates git python3 py3-requests && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache --update wget perl ca-certificates git python3 py3-requests
     mkdir -p /usr/local/lib/tunasync
+EOF
 ADD tunasync /usr/local/lib/tunasync
 ADD sync.sh sync.py /
diff --git a/aptsync/Dockerfile b/aptsync/Dockerfile
index 2653d40..dbd0708 100644
--- a/aptsync/Dockerfile
+++ b/aptsync/Dockerfile
@@ -4,8 +4,10 @@ LABEL bind_support=true
 ENV APTSYNC_NTHREADS=20 \
     APTSYNC_CREATE_DIR=true \
     APTSYNC_UNLINK=0
-RUN apk add --no-cache --update wget perl ca-certificates xz \
-        && mkdir -p /var/spool/apt-mirror/mirror /var/spool/apt-mirror/skel /etc/apt/
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache --update wget perl ca-certificates xz
+    mkdir -p /var/spool/apt-mirror/mirror /var/spool/apt-mirror/skel /etc/apt/
+EOF
 ADD ["apt-mirror", "/usr/local/bin/apt-mirror"]
-RUN chmod +x /usr/local/bin/apt-mirror
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/aptsync/apt-mirror b/aptsync/apt-mirror
old mode 100644
new mode 100755
diff --git a/base/Dockerfile.alpine b/base/Dockerfile.alpine
index 6211bfc..ab79a2f 100644
--- a/base/Dockerfile.alpine
+++ b/base/Dockerfile.alpine
@@ -1,8 +1,11 @@
 FROM alpine:3.20
 LABEL maintainer="Jian Zeng <anonymousknight96 AT gmail.com>" \
       org.ustcmirror.images=true
-RUN apk add --no-cache bash tzdata su-exec && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache bash tzdata su-exec
     ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+EOF
 ADD ["entry.sh", "savelog", "/usr/local/bin/"]
 ADD ["pip.conf", "/etc/"]
 VOLUME ["/data", "/log"]
diff --git a/base/Dockerfile.alpine-edge b/base/Dockerfile.alpine-edge
index bc14627..7943fd5 100644
--- a/base/Dockerfile.alpine-edge
+++ b/base/Dockerfile.alpine-edge
@@ -1,8 +1,11 @@
 FROM alpine:edge
 LABEL maintainer="Yifan Gao<git AT yfgao.com>" \
       org.ustcmirror.images=true
-RUN apk add --no-cache bash tzdata su-exec && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache bash tzdata su-exec
     ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+EOF
 ADD ["entry.sh", "savelog", "/usr/local/bin/"]
 VOLUME ["/data", "/log"]
 CMD ["entry.sh"]
diff --git a/base/Dockerfile.debian b/base/Dockerfile.debian
index 80c6153..ea24bc7 100644
--- a/base/Dockerfile.debian
+++ b/base/Dockerfile.debian
@@ -1,11 +1,18 @@
 FROM debian:bookworm-slim
 LABEL maintainer="Jian Zeng <anonymousknight96 AT gmail.com>" \
       org.ustcmirror.images=true
-RUN echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata && \
-    apt-get update && apt-get install -y wget && \
-    wget -O /usr/local/bin/su-exec https://ftp.lug.ustc.edu.cn/misc/su-exec && chmod +x /usr/local/bin/su-exec && \
-    echo "592f25c51d0e4c90945ece8c4fa35018d20a1091ac109c98b66eb95deef211c7 /usr/local/bin/su-exec" | sha256sum -c - && \
-    apt-get purge -y --auto-remove wget && rm -rf /var/lib/apt/lists/*
+RUN --mount=type=cache,target=/var/cache/apt \
+    --mount=type=cache,sharing=locked,target=/var/lib/apt <<EOF
+    
+    set -euo pipefail
+    echo 'Asia/Shanghai' > /etc/timezone
+    dpkg-reconfigure -f noninteractive tzdata
+    apt-get update && apt-get install -y wget
+    wget -O /usr/local/bin/su-exec https://ftp.lug.ustc.edu.cn/misc/su-exec
+    chmod +x /usr/local/bin/su-exec
+    echo "592f25c51d0e4c90945ece8c4fa35018d20a1091ac109c98b66eb95deef211c7 /usr/local/bin/su-exec" | sha256sum -c -
+    apt-get purge -y --auto-remove wget
+EOF
 ADD ["entry.sh", "savelog", "/usr/local/bin/"]
 VOLUME ["/data", "/log"]
 CMD ["entry.sh"]
diff --git a/docker-ce/Dockerfile b/docker-ce/Dockerfile
index a4e1135..2142b1c 100644
--- a/docker-ce/Dockerfile
+++ b/docker-ce/Dockerfile
@@ -1,7 +1,9 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Keyu Tao <taoky@ustclug.org>"
-RUN apk add --no-cache --update wget perl ca-certificates git python3 py3-requests py3-pip py3-lxml && \
-    pip3 install pyquery && \
-    mkdir -p /usr/local/lib/tunasync
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache --update wget perl ca-certificates git python3 py3-requests py3-pip py3-lxml
+    pip3 install pyquery
+EOF
 ADD tunasync /usr/local/lib/tunasync
 ADD sync.sh /
diff --git a/fedora/Dockerfile b/fedora/Dockerfile
index dc1d73e..29fbe60 100644
--- a/fedora/Dockerfile
+++ b/fedora/Dockerfile
@@ -1,7 +1,10 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Shengjing Zhu <zsj950618@gmail.com>"
 LABEL bind_support=true
-RUN apk add --no-cache zsh curl rsync ca-certificates gawk grep bzip2 coreutils diffutils findutils \
-    && curl -fLo /usr/local/bin/quick-fedora-mirror https://pagure.io/quick-fedora-mirror/raw/master/f/quick-fedora-mirror \
-    && chmod +x /usr/local/bin/quick-fedora-mirror
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache zsh curl rsync ca-certificates gawk grep bzip2 coreutils diffutils findutils
+    curl -fLo /usr/local/bin/quick-fedora-mirror https://pagure.io/quick-fedora-mirror/raw/master/f/quick-fedora-mirror
+    chmod +x /usr/local/bin/quick-fedora-mirror
+EOF
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/github-release/Dockerfile b/github-release/Dockerfile
index 6230eb7..0a5a93f 100644
--- a/github-release/Dockerfile
+++ b/github-release/Dockerfile
@@ -1,7 +1,6 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Yulong Ming <myl.ustc@gmail.com>"
 LABEL bind_support=true
-RUN apk add --no-cache python3 py3-requests py3-yaml && \
-    mkdir -p /usr/local/lib/tunasync
+RUN apk add --no-cache python3 py3-requests py3-yaml
 ADD tunasync /usr/local/lib/tunasync
 ADD sync.sh /
diff --git a/google-repo/Dockerfile b/google-repo/Dockerfile
index f10c9a4..aa8bf30 100644
--- a/google-repo/Dockerfile
+++ b/google-repo/Dockerfile
@@ -1,6 +1,9 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Keyu Tao <taoky AT lug.ustc.edu.cn>"
-RUN apk add --no-cache git curl python3 openssh-client gnupg && \
-    curl -fLo /usr/local/bin/repo https://storage.googleapis.com/git-repo-downloads/repo && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache git curl python3 openssh-client gnupg
+    curl -fLo /usr/local/bin/repo https://storage.googleapis.com/git-repo-downloads/repo
     chmod +x /usr/local/bin/repo
+EOF
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/gsutil-rsync/Dockerfile b/gsutil-rsync/Dockerfile
index 211c11a..955d384 100644
--- a/gsutil-rsync/Dockerfile
+++ b/gsutil-rsync/Dockerfile
@@ -1,9 +1,10 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Yao Wei (魏銘廷) <mwei@lxde.org>"
 
-RUN apk add --no-cache python3 py-setuptools openssl libffi && \
-    apk add --no-cache --virtual .build-deps gcc musl-dev python3-dev py3-pip openssl-dev libffi-dev && \
-    pip3 install --upgrade pip && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache python3 py-setuptools openssl libffi py3-pip
+    pip3 install --upgrade pip
     pip3 --no-cache-dir install gsutil
-
+EOF
 ADD pre-sync.sh sync.sh /
diff --git a/julia-storage/Dockerfile b/julia-storage/Dockerfile
index 654c380..f927e5e 100644
--- a/julia-storage/Dockerfile
+++ b/julia-storage/Dockerfile
@@ -2,11 +2,14 @@
 FROM ustcmirror/base:alpine
 
 ENV JULIA_DEPOT_PATH="/opt/julia/depot"
-RUN apk update && apk add --no-cache curl python3 gnupg py3-pip && \
-        pip3 install jill && jill install 1.5 --confirm && \
-        ln -s /opt/julias/julia-1.5 /opt/julia && \
-        julia -e 'using Pkg; pkg"add StorageMirrorServer@0.2.1"' && \
-        chmod a+rx -R $JULIA_DEPOT_PATH
+RUN <<EOF
+    apk update
+    apk add --no-cache curl python3 gnupg py3-pip
+    pip3 install jill && jill install 1.5 --confirm
+    ln -s /opt/julias/julia-1.5 /opt/julia
+    julia -e 'using Pkg; pkg"add StorageMirrorServer@0.2.1"'
+    chmod a+rx -R $JULIA_DEPOT_PATH
+EOF
 
 ADD startup.jl /opt/julia/etc/julia/startup.jl
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/nix-channels/Dockerfile b/nix-channels/Dockerfile
index 42f16e2..a240637 100644
--- a/nix-channels/Dockerfile
+++ b/nix-channels/Dockerfile
@@ -1,17 +1,19 @@
 FROM ustcmirror/base:alpine
 
-RUN \
+RUN <<EOF
+    set -euo pipefail
     # Install Nix. To simplify management we only copy binaries and create
     # symlinks, and do no further configuration
-    wget https://nixos.org/releases/nix/nix-2.3.2/nix-2.3.2-x86_64-linux.tar.xz -O /tmp/nix.tar.xz && \
-    mkdir /tmp/nix.unpack && \
-    tar xpf /tmp/nix.tar.xz -C /tmp/nix.unpack && \
-    mkdir /nix && \
-    cp -dpr /tmp/nix.unpack/*/store /nix/store && \
-    ln -s /nix/store/*-nix-*/bin/* /usr/local/bin && \
-    rm -rf /tmp/nix.tar.xz /tmp/nix.unpack && \
+    wget https://nixos.org/releases/nix/nix-2.3.2/nix-2.3.2-x86_64-linux.tar.xz -O /tmp/nix.tar.xz
+    mkdir /tmp/nix.unpack
+    tar xpf /tmp/nix.tar.xz -C /tmp/nix.unpack
+    mkdir /nix
+    cp -dpr /tmp/nix.unpack/*/store /nix/store
+    ln -s /nix/store/*-nix-*/bin/* /usr/local/bin
+    rm -rf /tmp/nix.tar.xz /tmp/nix.unpack
     # ca-certificates required by nix
-    apk add --no-cache ca-certificates python3 py3-requests py3-pip py3-lxml py3-tz && \
+    apk add --no-cache ca-certificates python3 py3-requests py3-pip py3-lxml py3-tz
     pip3 install pyquery minio==6.0.2
+EOF
 
 ADD [ "sync.sh", "nix-channels.py", "/" ]
diff --git a/pypi/Dockerfile b/pypi/Dockerfile
index c8aa646..94c6bf8 100644
--- a/pypi/Dockerfile
+++ b/pypi/Dockerfile
@@ -4,7 +4,10 @@ ENV PYPI_MASTER=https://pypi.python.org \
     BANDERSNATCH_WORKERS=3 \
     BANDERSNATCH_STOP_ON_ERROR=true \
     BANDERSNATCH_TIMEOUT=20
-RUN apk add --no-cache python3 python3-dev py3-pip musl-dev gcc libxml2 libxslt libxml2-dev libxslt-dev && \
-    pip3 --no-cache-dir install bandersnatch && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache python3 python3-dev py3-pip musl-dev gcc libxml2 libxslt libxml2-dev libxslt-dev
+    pip3 --no-cache-dir install bandersnatch
     apk del --purge python3-dev musl-dev gcc libxml2-dev libxslt-dev
+EOF
 ADD sync.sh pre-sync.sh /
diff --git a/rclone/Dockerfile b/rclone/Dockerfile
index fbb2367..942b5dd 100644
--- a/rclone/Dockerfile
+++ b/rclone/Dockerfile
@@ -6,10 +6,13 @@ ARG RCLONE_VERSION=v1.50.2
 ENV RCLONE_DELETE_AFTER=true \
     RCLONE_DELETE_EXCLUDED=true
 
-RUN apk add --no-cache wget ca-certificates && \
-    cd /tmp/ && wget -q "https://downloads.rclone.org/$RCLONE_VERSION/rclone-$RCLONE_VERSION-linux-amd64.zip" && \
-    unzip /tmp/rclone*.zip && \
-    mv /tmp/rclone-*/rclone /usr/local/bin/ && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates
+    cd /tmp/ && wget -q "https://downloads.rclone.org/$RCLONE_VERSION/rclone-$RCLONE_VERSION-linux-amd64.zip"
+    unzip /tmp/rclone*.zip
+    mv /tmp/rclone-*/rclone /usr/local/bin/
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /
diff --git a/shadowmire/Dockerfile b/shadowmire/Dockerfile
index 4b4ce34..3c41d34 100644
--- a/shadowmire/Dockerfile
+++ b/shadowmire/Dockerfile
@@ -2,10 +2,13 @@ FROM ustcmirror/base:alpine
 LABEL maintainer="Keyu Tao <taoky AT ustclug.org>"
 ARG COMMIT=0a6a958e49ed1ce287596f04414fc21faf4ffac8
 
-RUN apk add --no-cache wget ca-certificates python3 py3-click py3-requests py3-tqdm && \
-    cd /tmp/ && wget -q "https://raw.githubusercontent.com/taoky/shadowmire/$COMMIT/shadowmire.py" && \
-    mv /tmp/shadowmire.py /usr/local/bin/shadowmire && \
-    chmod +x /usr/local/bin/shadowmire && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates python3 py3-click py3-requests py3-tqdm
+    cd /tmp/ && wget -q "https://raw.githubusercontent.com/taoky/shadowmire/$COMMIT/shadowmire.py"
+    mv /tmp/shadowmire.py /usr/local/bin/shadowmire
+    chmod +x /usr/local/bin/shadowmire
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /
diff --git a/tsumugu/Dockerfile b/tsumugu/Dockerfile
index 86d4398..0ae7b27 100644
--- a/tsumugu/Dockerfile
+++ b/tsumugu/Dockerfile
@@ -3,10 +3,13 @@ LABEL maintainer="Keyu Tao <taoky AT ustclug.org>"
 LABEL bind_support=true
 ARG TSUMUGU_VERSION=20240811
 
-RUN apk add --no-cache wget ca-certificates && \
-    cd /tmp/ && wget -q "https://github.com/taoky/tsumugu/releases/download/${TSUMUGU_VERSION}/tsumugu" && \
-    mv /tmp/tsumugu /usr/local/bin/ && \
-    chmod +x /usr/local/bin/tsumugu && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates
+    cd /tmp/ && wget -q "https://github.com/taoky/tsumugu/releases/download/${TSUMUGU_VERSION}/tsumugu"
+    mv /tmp/tsumugu /usr/local/bin/
+    chmod +x /usr/local/bin/tsumugu
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /
diff --git a/winget-source/Dockerfile b/winget-source/Dockerfile
index d413c7a..f59334c 100644
--- a/winget-source/Dockerfile
+++ b/winget-source/Dockerfile
@@ -5,9 +5,13 @@ LABEL bind_support=true
 RUN apk add --no-cache nodejs
 
 ADD ["package.json", "package-lock.json", "/"]
-RUN apk add --no-cache npm python3 && \
-    npm ci --prefix / --only=production && \
-    npm cache clean --force && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache npm python3
+    npm ci --prefix / --only=production
+    npm cache clean --force
     apk del --purge --no-cache npm python3
+EOF
+RUN 
 
 ADD ["sync.sh", "sync-repo.js", "sysexits.js", "utilities.js", "/"]
diff --git a/yukina/Dockerfile b/yukina/Dockerfile
index 4b46a78..e2b4e0a 100644
--- a/yukina/Dockerfile
+++ b/yukina/Dockerfile
@@ -3,10 +3,13 @@ LABEL maintainer="Keyu Tao <taoky AT ustclug.org>"
 LABEL bind_support=true
 ARG YUKINA_VERSION=20240811
 
-RUN apk add --no-cache wget ca-certificates zstd && \
-    cd /tmp/ && wget -q "https://github.com/taoky/yukina/releases/download/${YUKINA_VERSION}/yukina" && \
-    mv /tmp/yukina /usr/local/bin/ && \
-    chmod +x /usr/local/bin/yukina && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates zstd
+    cd /tmp/ && wget -q "https://github.com/taoky/yukina/releases/download/${YUKINA_VERSION}/yukina"
+    mv /tmp/yukina /usr/local/bin/
+    chmod +x /usr/local/bin/yukina
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /