diff --git a/BUILD.bazel b/BUILD.bazel
index 3e497219d..e18ea8c4a 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -25,16 +25,18 @@ genrule(
 container_bundle(
     name = "images",
     images = {
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//build:controller",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//build:acmesolver",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//build:webhook",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//build:cainjector",
     },
+    tags = ["manual"],
 )
 
 docker_push(
     name = "images.push",
     bundle = ":images",
+    tags = ["manual"],
 )
 
 filegroup(
diff --git a/build/BUILD.bazel b/build/BUILD.bazel
index c908a5237..9cc5e3b4c 100644
--- a/build/BUILD.bazel
+++ b/build/BUILD.bazel
@@ -44,6 +44,7 @@ DOCKERIZED_BINARIES = {
         "/usr/local/bin/" + binary: "/usr/bin/" + binary,
     },
     tags = ["manual"],
+    user = "1000",
     visibility = ["//visibility:private"],
 ) for binary, meta in DOCKERIZED_BINARIES.items()]
 
diff --git a/cmd/acmesolver/BUILD.bazel b/cmd/acmesolver/BUILD.bazel
index 411723056..1dbf3296d 100644
--- a/cmd/acmesolver/BUILD.bazel
+++ b/cmd/acmesolver/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":acmesolver",
-    component = "acmesolver",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "acmesolver",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = ["main.go"],
diff --git a/cmd/cainjector/BUILD.bazel b/cmd/cainjector/BUILD.bazel
index 60a897601..ec5e90838 100644
--- a/cmd/cainjector/BUILD.bazel
+++ b/cmd/cainjector/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":cainjector",
-    component = "cainjector",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "cainjector",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = [
diff --git a/cmd/controller/BUILD.bazel b/cmd/controller/BUILD.bazel
index a838a3c29..085ab85ec 100644
--- a/cmd/controller/BUILD.bazel
+++ b/cmd/controller/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":controller",
-    component = "controller",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "controller",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = [
diff --git a/cmd/webhook/BUILD.bazel b/cmd/webhook/BUILD.bazel
index 82717275f..10fb1edca 100644
--- a/cmd/webhook/BUILD.bazel
+++ b/cmd/webhook/BUILD.bazel
@@ -1,20 +1,6 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
-load("//hack/build:docker.bzl", "covered_image", "image")
 load("//build:version.bzl", "version_x_defs")
 
-image(
-    name = "image",
-    binary = ":webhook",
-    component = "webhook",
-    visibility = ["//visibility:public"],
-)
-
-covered_image(
-    name = "image.covered",
-    component = "webhook",
-    visibility = ["//visibility:public"],
-)
-
 go_library(
     name = "go_default_library",
     srcs = ["main.go"],
diff --git a/devel/addon/certmanager/BUILD.bazel b/devel/addon/certmanager/BUILD.bazel
index 8749bb1b6..43f08ceba 100644
--- a/devel/addon/certmanager/BUILD.bazel
+++ b/devel/addon/certmanager/BUILD.bazel
@@ -3,10 +3,10 @@ load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
 container_bundle(
     name = "bundle",
     images = {
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//build:controller",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//build:acmesolver",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//build:webhook",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//build:cainjector",
     },
     tags = ["manual"],
 )
diff --git a/devel/addon/pebble/BUILD.bazel b/devel/addon/pebble/BUILD.bazel
index 0da887d61..a1337a6fe 100644
--- a/devel/addon/pebble/BUILD.bazel
+++ b/devel/addon/pebble/BUILD.bazel
@@ -16,6 +16,7 @@ go_image(
     name = "image",
     base = "@static_base//image",
     binary = ":app",
+    tags = ["manual"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/devel/addon/samplewebhook/sample/BUILD.bazel b/devel/addon/samplewebhook/sample/BUILD.bazel
index 49f1cf2a0..44049ddcf 100644
--- a/devel/addon/samplewebhook/sample/BUILD.bazel
+++ b/devel/addon/samplewebhook/sample/BUILD.bazel
@@ -5,6 +5,7 @@ go_image(
     name = "image",
     base = "@static_base//image",
     binary = ":sample",
+    tags = ["manual"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/hack/build/docker.bzl b/hack/build/docker.bzl
index ad4af395b..bb31ec73a 100644
--- a/hack/build/docker.bzl
+++ b/hack/build/docker.bzl
@@ -17,38 +17,6 @@ load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
 load("@io_bazel_rules_docker//go:image.bzl", "go_image")
 load("@io_bazel_rules_go//go:def.bzl", "go_test")
 
-def image(
-    name,
-    component,
-    binary,
-    user = "1000",
-    stamp = True,
-    testonly = False,
-    **kwargs):
-
-    go_image(
-        name = "%s.app" % name,
-        base = "@static_base//image",
-        binary = binary,
-        testonly = testonly,
-    )
-
-    container_image(
-        name = name,
-        base = "%s.app" % name,
-        user = user,
-        stamp = stamp,
-        testonly = testonly,
-        **kwargs)
-
-    container_bundle(
-        name = name + ".export",
-        images = {
-            component + ":{STABLE_APP_GIT_COMMIT}": ":" + name,
-        },
-        testonly = testonly,
-    )
-
 def covered_image(name, component, **kwargs):
     native.genrule(
         name = "%s.covered-testfile" % name,
@@ -84,9 +52,23 @@ EOF
         tags = ["manual"],
     )
 
-    image(
-        name = name,
+    go_image(
+        name = "%s.covered-image" % name,
+        base = "@static_base//image",
         binary = "%s.covered-app" % name,
         testonly = True,
-        component = component,
+    )
+
+    container_image(
+        name = name,
+        base = "%s.covered-image" % name,
+        testonly = True,
         **kwargs)
+
+    container_bundle(
+        name = name + ".export",
+        images = {
+            component + ":{STABLE_APP_GIT_COMMIT}": ":" + name,
+        },
+        testonly = True,
+    )
diff --git a/test/e2e/BUILD.bazel b/test/e2e/BUILD.bazel
index 9fc53410f..1af33c554 100644
--- a/test/e2e/BUILD.bazel
+++ b/test/e2e/BUILD.bazel
@@ -11,10 +11,10 @@ container_bundle(
         "vault:bazel": "@com_hashicorp_vault//image",
         "sample-webhook:bazel": "//test/e2e/framework/addon/samplewebhook/sample:image",
         "gcr.io/kubernetes-helm/tiller:bazel": "@io_gcr_helm_tiller//image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//cmd/controller:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//cmd/acmesolver:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//cmd/webhook:image",
-        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//cmd/cainjector:image",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-controller:{STABLE_DOCKER_TAG}": "//build:controller",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-acmesolver:{STABLE_DOCKER_TAG}": "//build:acmesolver",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-webhook:{STABLE_DOCKER_TAG}": "//build:webhook",
+        "{STABLE_DOCKER_REGISTRY}/cert-manager-cainjector:{STABLE_DOCKER_TAG}": "//build:cainjector",
     },
     tags = ["manual"],
 )
@@ -73,7 +73,6 @@ filegroup(
     srcs = [
         ":package-srcs",
         "//test/e2e/bin/cloudflare-clean:all-srcs",
-        "//test/e2e/charts:all-srcs",
         "//test/e2e/framework:all-srcs",
         "//test/e2e/suite:all-srcs",
         "//test/e2e/util:all-srcs",
diff --git a/test/e2e/charts/BUILD.bazel b/test/e2e/charts/BUILD.bazel
deleted file mode 100644
index 91c378fe9..000000000
--- a/test/e2e/charts/BUILD.bazel
+++ /dev/null
@@ -1,28 +0,0 @@
-load("@io_bazel_rules_docker//container:bundle.bzl", "container_bundle")
-
-container_bundle(
-    name = "images",
-    images = {
-        # A set of images to bundle up into a single tarball.
-        "pebble:bazel": "//test/e2e/charts/pebble:image",
-        "quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1": "@io_kubernetes_ingress-nginx//image",
-        "k8s.gcr.io/defaultbackend-amd64:bazel": "@io_gcr_k8s_defaultbackend//image",
-        "vault:bazel": "@com_hashicorp_vault//image",
-        "gcr.io/kubernetes-helm/tiller:bazel": "@io_gcr_helm_tiller//image",
-    },
-    tags = ["manual"],
-)
-
-filegroup(
-    name = "package-srcs",
-    srcs = glob(["**"]),
-    tags = ["automanaged"],
-    visibility = ["//visibility:private"],
-)
-
-filegroup(
-    name = "all-srcs",
-    srcs = [":package-srcs"],
-    tags = ["automanaged"],
-    visibility = ["//visibility:public"],
-)