diff --git a/.circleci/config.yml b/.circleci/config.yml
index 66256724d1..424a5f78c8 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -45,6 +45,14 @@ orbs:
     attach_workspace:
       at: ./
 
+  # Only run on PRs
+  only-prs: &only-prs
+    filters:
+      branches:
+        ignore: /^main|0\.12$/
+      tags:
+        ignore: /.*/
+
   # Only run jobs on main
   only-main: &only-main
     filters:
@@ -53,13 +61,13 @@ orbs:
       tags:
         ignore: /.*/
 
-  # Only run on versioned tags
-  only-tags: &only-tags
+  # Only run on versioned acorn tags
+  only-acorn-tags: &only-acorn-tags
     filters:
       branches:
         ignore: /.*/
       tags:
-        only: /\d+\.\d+\.\d+(-\d+)?/
+        only: /0\.12\.\d+(-[a-zA-Z0-9]+)?/
 
   # Only run for PRs from core team
   only-internal-prs: &only-internal-prs
@@ -375,114 +383,62 @@ jobs:
             yarn e2e-project --project=<<parameters.project>> --env=<<parameters.environment>>
       - cleanup_remote_cluster
 
-  build-docker-alpine:
-    <<: *node-config
-    steps:
-      - *remote-docker
-      - checkout
-      - *attach-workspace
-      - docker_login
-      - run:
-          name: Build image and push to registry
-          command: |
-            TAG=gardendev/garden:${CIRCLE_SHA1}
-            docker build -t ${TAG} -f support/alpine.Dockerfile dist/alpine-amd64
-            docker push ${TAG}
-  build-docker-aws:
-    <<: *node-config
-    steps:
-      - *remote-docker
-      - checkout
-      - *attach-workspace
-      - docker_login
-      - run:
-          name: Build image and push to registry
-          command: |
-            TAG=gardendev/garden-aws:${CIRCLE_SHA1}
-            docker build -t ${TAG} --build-arg TAG=${CIRCLE_SHA1} -f support/aws.Dockerfile dist/alpine-amd64
-            docker push ${TAG}
-  build-docker-azure:
-    <<: *node-config
-    steps:
-      - *remote-docker
-      - checkout
-      - *attach-workspace
-      - docker_login
-      - run:
-          name: Build image and push to registry
-          command: |
-            TAG=gardendev/garden-azure:${CIRCLE_SHA1}
-            docker build -t ${TAG} --build-arg TAG=${CIRCLE_SHA1} -f support/azure.Dockerfile dist/alpine-amd64
-            docker push ${TAG}
-  build-docker-gcloud:
-    <<: *node-config
-    steps:
-      - *remote-docker
-      - checkout
-      - *attach-workspace
-      - docker_login
-      - run:
-          name: Build image and push to registry
-          command: |
-            TAG=gardendev/garden-gcloud:${CIRCLE_SHA1}
-            docker build -t ${TAG} --build-arg TAG=${CIRCLE_SHA1} -f support/gcloud.Dockerfile dist/alpine-amd64
-            docker push ${TAG}
-  build-docker-aws-gcloud:
-    <<: *node-config
-    steps:
-      - *remote-docker
-      - checkout
-      - *attach-workspace
-      - docker_login
-      - run:
-          name: Build image and push to registry
-          command: |
-            TAG=gardendev/garden-aws-gcloud:${CIRCLE_SHA1}
-            docker build -t ${TAG} --build-arg TAG=${CIRCLE_SHA1} -f support/aws-gcloud.Dockerfile dist/alpine-amd64
-            docker push ${TAG}
-  build-docker-aws-gcloud-azure:
-    <<: *node-config
-    steps:
-      - *remote-docker
-      - checkout
-      - *attach-workspace
-      - docker_login
-      - run:
-          name: Build image and push to registry
-          command: |
-            TAG=gardendev/garden-aws-gcloud-azure:${CIRCLE_SHA1}
-            docker build -t ${TAG} --build-arg TAG=${CIRCLE_SHA1} -f support/aws-gcloud-azure.Dockerfile dist/alpine-amd64
-            docker push ${TAG}
-  build-docker-full:
+  test-dockerhub:
     <<: *node-config
     steps:
       - *remote-docker
       - checkout
+      # This is to copy the pre-built code from a previous step
       - *attach-workspace
-      - docker_login
-      - run:
-          name: Build image and push to registry
+      - deploy:
+          name: Build and test docker images
           command: |
-            TAG=gardendev/garden-full:${CIRCLE_SHA1}
-            docker build -t ${TAG} --build-arg TAG=${CIRCLE_SHA1} -f support/full.Dockerfile dist/alpine-amd64
-            docker push ${TAG}
-  build-docker-buster:
+            bash support/docker-bake-test.sh
+  dockerhub-release:
     <<: *node-config
     steps:
       - *remote-docker
       - checkout
+      # This is to copy the pre-built code from a previous step
       - *attach-workspace
       - docker_login
-      - run:
-          name: Build image and push to registry
+      # TODO: use garden publish here
+      - deploy:
+          name: Release docker images
           command: |
-            TAG=gardendev/garden:${CIRCLE_SHA1}-buster
-            docker build -t ${TAG} -f support/buster.Dockerfile dist/linux-amd64
-            docker push ${TAG}
+            if [[ -z "${CIRCLE_TAG}" ]]; then
+              if [[ ${CIRCLE_TAG} !~ "^0.12" ]]; then
+                echo "This pipeline should only build 0.12 releases"
+                exit 1
+              fi
+
+              # Parse SemVer tag into different parts
+              regex="^([0-9]+)\.([0-9]+)\.([0-9]+)(-([0-9A-Za-z-]+))?(\+([0-9A-Za-z-]+))?$"
+
+              # production release, or prerelease
+              if [[ ${CIRCLE_TAG} =~ $regex ]]; then
+                  export MAJOR_VERSION=${BASH_REMATCH[1]}
+                  export MINOR_VERSION=${BASH_REMATCH[2]}
+                  export PATCH_VERSION=${BASH_REMATCH[3]}
+                  export PRERELEASE=${BASH_REMATCH[5]}
+              else
+                  echo "Invalid SemVer tag."
+                  exit 1
+              fi
+            else
+              # 0.12 edge release
+              export MAJOR_VERSION=0
+              export MINOR_VERSION=12
+              export CODENAME=acorn
+              export PRERELEASE=edge
+            fi
+
+            # Build and publish
+            docker buildx bake --push --progress=plain -f support/docker-bake.hcl all
 
   test-docker-gcloud:
     docker:
-      - image: gardendev/garden-gcloud:${CIRCLE_SHA1}
+      - image: gardendev/garden-gcloud:0.12-edge-alpine
         environment:
           <<: *shared-env-config
           GARDEN_TASK_CONCURRENCY_LIMIT: "10"
@@ -497,27 +453,7 @@ jobs:
           command: CIRCLE_BUILD_NUM=$CIRCLE_BUILD_NUM-docker /garden/garden build --root examples/demo-project --env remote --logger-type basic
       - cleanup_remote_cluster
 
-  release-service-docker:
-    <<: *node-config
-    steps:
-      - *remote-docker
-      - checkout
-      # This is to copy the pre-built code from a previous step
-      - *attach-workspace
-      - docker_login
-      # TODO: use garden publish here
-      - deploy:
-          name: Release docker images
-          command: |
-            # Switches between git tag and main for releases
-            TAG=${CIRCLE_TAG:-main}
-            # Push the container
-            ./scripts/push-containers.sh $TAG
-            # Push again with latest tag for non-pre-release tags
-            if [[ "$TAG" == "$CIRCLE_TAG" ]] && [[ $VERSION != *"-"* ]]; then
-              ./scripts/push-containers.sh latest
-            fi
-  release-service-dist:
+  github-release-tag:
     <<: *release-config
     steps:
       # Need to checkout to read version from core/package.json
@@ -541,7 +477,7 @@ jobs:
               ${PRERELEASE} \
               ${DRAFT} \
               ${VERSION} ./dist
-  release-service-dist-edge:
+  github-edge-prerelease:
     <<: *release-config
     steps:
       - *attach-workspace
@@ -881,43 +817,6 @@ workflows:
           requires: [build]
       - check-package-licenses:
           requires: [build]
-      - build-docker-alpine:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-dist]
-      - build-docker-aws:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-docker-alpine]
-      - build-docker-azure:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-docker-alpine]
-      - build-docker-gcloud:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-docker-alpine]
-      - build-docker-aws-gcloud:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-docker-gcloud]
-      - build-docker-aws-gcloud-azure:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-docker-gcloud]
-      - build-docker-full:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-docker-gcloud]
-      - build-docker-buster:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-dist]
-
-      - test-docker-gcloud:
-          <<: *only-internal-prs
-          context: docker
-          requires: [build-docker-gcloud]
       - test-framework:
           requires: [build]
       - test-dist:
@@ -927,6 +826,9 @@ workflows:
       - test-macos:
           <<: *only-internal-prs
           requires: [build-dist]
+      - test-dockerhub:
+          <<: *only-prs
+          requires: [build-dist]
       - test-windows:
           <<: *only-internal-prs
           requires: [build-dist]
@@ -1069,25 +971,29 @@ workflows:
       - build-dist-edge:
           <<: *only-main
           requires: [build]
-      - release-service-docker:
+      - dockerhub-release:
           <<: *only-main
           context: docker
           requires: [build-dist-edge]
-      - release-service-dist-edge:
+      - test-docker-gcloud:
+          <<: *only-main
+          context: docker
+          requires: [dockerhub-release]
+      - github-edge-prerelease:
           <<: *only-main
           requires: [build-dist-edge]
 
   tags:
     jobs:
       - build:
-          <<: *only-tags
+          <<: *only-acorn-tags
       - build-dist:
-          <<: *only-tags
+          <<: *only-acorn-tags
           requires: [build]
-      - release-service-docker:
-          <<: *only-tags
+      - dockerhub-release:
+          <<: *only-acorn-tags
           context: docker
           requires: [build-dist]
-      - release-service-dist:
-          <<: *only-tags
+      - github-release-tag:
+          <<: *only-acorn-tags
           requires: [build-dist]
diff --git a/support/alpine.Dockerfile b/support/alpine.Dockerfile
index c953335250..533179f61f 100644
--- a/support/alpine.Dockerfile
+++ b/support/alpine.Dockerfile
@@ -1,5 +1,7 @@
-ARG NODE_VERSION=18-alpine3.17
-FROM node:${NODE_VERSION}
+#
+# base
+#
+FROM node:18-alpine3.17 AS garden-alpine-base
 
 RUN apk add --no-cache \
   bash \
@@ -26,3 +28,94 @@ RUN chmod +x /garden/garden \
   && GARDEN_DISABLE_ANALYTICS=true GARDEN_DISABLE_VERSION_CHECK=true garden util fetch-tools --all --garden-image-build --logger-type=basic
 
 ENTRYPOINT ["/garden/garden"]
+
+#
+# gcloud tools
+#
+FROM google/cloud-sdk:411.0.0-alpine as gcloud-tools
+
+RUN gcloud components install kubectl gke-gcloud-auth-plugin --quiet
+
+#
+# garden-gcloud
+#
+FROM garden-alpine-base as garden-gcloud
+
+ENV CLOUDSDK_PYTHON=python3
+
+COPY --from=gcloud-tools /google-cloud-sdk /google-cloud-sdk
+ENV PATH /google-cloud-sdk/bin:$PATH
+
+RUN apk add --no-cache python3 py3-pip libc6-compat py3-openssl gnupg openssh-client py3-crcmod \
+  && ln -s /google-cloud-sdk/bin/* /usr/local/bin/ \
+  && chmod +x /usr/local/bin/* \
+  && gcloud version
+
+#
+# garden-azure
+#
+FROM garden-alpine-base as garden-azure
+
+# Build dependencies
+RUN apk add --virtual=build gcc libffi-dev musl-dev openssl-dev make readline linux-pam \
+# Runtime dependency
+  && apk add bash sudo shadow python3-dev py3-pip && pip3 install -U pip \
+# Actual azure cli
+  && pip3 --no-cache-dir install azure-cli \
+# Remove build dependencies
+  && apk del --purge build
+
+RUN az aks install-cli # this will install the latest version of kubelogin if you need to pin to a specific version use --kubelogin-version v0.0.20
+
+# Required by Azure DevOps to tell the system where node is installed
+LABEL "com.azure.dev.pipelines.agent.handler.node.path"="/usr/local/bin/node"
+
+#
+# garden-aws
+#
+FROM garden-alpine-base as garden-aws
+
+RUN apk add --no-cache python3 py3-pip \
+  && pip install awscli==1.22.77 --upgrade
+
+RUN curl -o aws-iam-authenticator https://amazon-eks.s3.us-west-2.amazonaws.com/1.15.10/2020-02-22/bin/linux/amd64/aws-iam-authenticator \
+  && chmod +x ./aws-iam-authenticator \
+  && mv ./aws-iam-authenticator /usr/bin/
+
+#
+# garden-aws-gcloud
+#
+FROM garden-gcloud as garden-aws-gcloud
+
+RUN pip install awscli==1.22.77 --upgrade
+
+RUN curl -o aws-iam-authenticator https://amazon-eks.s3.us-west-2.amazonaws.com/1.15.10/2020-02-22/bin/linux/amd64/aws-iam-authenticator \
+  && chmod +x ./aws-iam-authenticator \
+  && mv ./aws-iam-authenticator /usr/bin/
+
+#
+# garden-aws-gcloud-azure
+#
+FROM garden-gcloud as garden-aws-gcloud-azure
+
+ENV KUBELOGIN_VERSION=v0.0.24
+
+RUN pip install awscli==1.22.77 --upgrade
+
+RUN curl -o aws-iam-authenticator https://amazon-eks.s3.us-west-2.amazonaws.com/1.15.10/2020-02-22/bin/linux/amd64/aws-iam-authenticator \
+  && chmod +x ./aws-iam-authenticator \
+  && mv ./aws-iam-authenticator /usr/bin/
+
+# Build dependencies
+RUN apk add --virtual=build gcc libffi-dev musl-dev openssl-dev make py3-pip\
+  # Runtime dependency
+  && apk add python3-dev \
+  && pip3 install virtualenv \
+  && python3 -m virtualenv /azure-cli \
+  && /azure-cli/bin/python -m pip --no-cache-dir install azure-cli \
+  && echo "#!/usr/bin/env sh" > /usr/bin/az \
+  && echo '/azure-cli/bin/python -m azure.cli "$@"' >> /usr/bin/az \
+  && chmod +x /usr/bin/az \
+  && wget https://github.com/Azure/kubelogin/releases/download/${KUBELOGIN_VERSION}/kubelogin-linux-amd64.zip \
+  && unzip kubelogin-linux-amd64.zip \
+  && cp bin/linux_amd64/kubelogin /usr/bin/
diff --git a/support/aws-gcloud-azure.Dockerfile b/support/aws-gcloud-azure.Dockerfile
deleted file mode 100644
index d8cbf8294f..0000000000
--- a/support/aws-gcloud-azure.Dockerfile
+++ /dev/null
@@ -1,24 +0,0 @@
-ARG TAG=latest
-FROM gardendev/garden-gcloud:${TAG}
-
-ENV KUBELOGIN_VERSION=v0.0.24
-
-RUN pip install awscli==1.22.77 --upgrade
-
-RUN curl -o aws-iam-authenticator https://amazon-eks.s3.us-west-2.amazonaws.com/1.15.10/2020-02-22/bin/linux/amd64/aws-iam-authenticator \
-  && chmod +x ./aws-iam-authenticator \
-  && mv ./aws-iam-authenticator /usr/bin/
-
-# Build dependencies
-RUN apk add --virtual=build gcc libffi-dev musl-dev openssl-dev make py3-pip\
-  # Runtime dependency
-  && apk add python3-dev \
-  && pip3 install virtualenv \
-  && python3 -m virtualenv /azure-cli \
-  && /azure-cli/bin/python -m pip --no-cache-dir install azure-cli \
-  && echo "#!/usr/bin/env sh" > /usr/bin/az \
-  && echo '/azure-cli/bin/python -m azure.cli "$@"' >> /usr/bin/az \
-  && chmod +x /usr/bin/az \
-  && wget https://github.com/Azure/kubelogin/releases/download/${KUBELOGIN_VERSION}/kubelogin-linux-amd64.zip \
-  && unzip kubelogin-linux-amd64.zip \
-  && cp bin/linux_amd64/kubelogin /usr/bin/
diff --git a/support/aws-gcloud.Dockerfile b/support/aws-gcloud.Dockerfile
deleted file mode 100644
index c72c9abdc9..0000000000
--- a/support/aws-gcloud.Dockerfile
+++ /dev/null
@@ -1,8 +0,0 @@
-ARG TAG=latest
-FROM gardendev/garden-gcloud:${TAG}
-
-RUN pip install awscli==1.22.77 --upgrade
-
-RUN curl -o aws-iam-authenticator https://amazon-eks.s3.us-west-2.amazonaws.com/1.15.10/2020-02-22/bin/linux/amd64/aws-iam-authenticator \
-  && chmod +x ./aws-iam-authenticator \
-  && mv ./aws-iam-authenticator /usr/bin/
\ No newline at end of file
diff --git a/support/aws.Dockerfile b/support/aws.Dockerfile
deleted file mode 100644
index 76476f250c..0000000000
--- a/support/aws.Dockerfile
+++ /dev/null
@@ -1,9 +0,0 @@
-ARG TAG=latest
-FROM gardendev/garden:${TAG}
-
-RUN apk add --no-cache python3 py3-pip \
-  && pip install awscli==1.22.77 --upgrade
-
-RUN curl -o aws-iam-authenticator https://amazon-eks.s3.us-west-2.amazonaws.com/1.15.10/2020-02-22/bin/linux/amd64/aws-iam-authenticator \
-  && chmod +x ./aws-iam-authenticator \
-  && mv ./aws-iam-authenticator /usr/bin/
diff --git a/support/azure.Dockerfile b/support/azure.Dockerfile
deleted file mode 100644
index e26530fca7..0000000000
--- a/support/azure.Dockerfile
+++ /dev/null
@@ -1,16 +0,0 @@
-ARG TAG=latest
-FROM gardendev/garden:${TAG}
-
-# Build dependencies
-RUN apk add --virtual=build gcc libffi-dev musl-dev openssl-dev make readline linux-pam \
-# Runtime dependency
-  && apk add bash sudo shadow python3-dev py3-pip && pip3 install -U pip \
-# Actual azure cli
-  && pip3 --no-cache-dir install azure-cli \
-# Remove build dependencies
-  && apk del --purge build
-
-RUN az aks install-cli # this will install the latest version of kubelogin if you need to pin to a specific version use --kubelogin-version v0.0.20
-
-# Required by Azure DevOps to tell the system where node is installed
-LABEL "com.azure.dev.pipelines.agent.handler.node.path"="/usr/local/bin/node"
diff --git a/support/buster.Dockerfile b/support/buster.Dockerfile
index 4e1daf6267..e5f871dc04 100644
--- a/support/buster.Dockerfile
+++ b/support/buster.Dockerfile
@@ -1,4 +1,4 @@
-FROM node:14.19.3-buster
+FROM node:14.19.3-buster as buster-base
 
 # system dependencies
 RUN set -ex; \
diff --git a/support/docker-bake-test.sh b/support/docker-bake-test.sh
new file mode 100644
index 0000000000..b13644a9a9
--- /dev/null
+++ b/support/docker-bake-test.sh
@@ -0,0 +1,190 @@
+#!/bin/bash
+
+set -x -e -o pipefail
+
+# Bash test framework. Sorry :D
+fail() {
+  echo "FAIL: $@"
+  exit 1
+}
+
+tag_exists() {
+  image=$1
+  tag=$2
+
+  docker image ls "$image" | grep "$tag" > /dev/null
+}
+
+should_exist() {
+  if tag_exists $@; then
+    echo "OK: $image:$tag exists"
+  else
+    fail "$image: tag \"$tag\" should exist"
+  fi
+}
+
+should_not_exist() {
+  if tag_exists $@; then
+    fail "$image: tag \"$tag\" should not exist"
+  else
+    echo "OK: $image:$tag does not exist"
+  fi
+}
+
+run_binary() {
+  binary=$1
+  command=$2
+  image=$3
+
+  docker run --platform=linux/amd64 --rm -it --entrypoint=$binary $image $command
+}
+
+should_succeed() {
+  if run_binary $@; then
+    echo "OK: command run_binary $@ succeeded as expected"
+  else
+    fail "command run_binary $@ should have succeeded"
+  fi
+}
+
+should_fail() {
+  if run_binary $@; then
+    fail "command run_binary $@ should have failed"
+  else
+    echo "OK: command run_binary $@ failed as expected"
+  fi
+}
+
+before_each() {
+  # Clean all docker image tags
+  docker images --format "{{.Repository}}:{{.Tag}}" | xargs docker rmi  || true
+}
+
+TEST() {
+  echo "TEST: $@"
+  before_each
+}
+
+TEST "test cloud provider tool availability"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PATCH_VERSION=0 CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl alpine
+
+  # aws
+  should_succeed aws --version gardendev/garden-aws-gcloud-azure
+  should_succeed aws --version gardendev/garden-aws-gcloud
+  should_succeed aws --version gardendev/garden-aws
+  should_fail aws --version gardendev/garden
+  should_fail aws --version gardendev/garden-gcloud
+  should_fail aws --version gardendev/garden-azure
+
+  # Gcloud
+  should_succeed gcloud version gardendev/garden-aws-gcloud-azure
+  should_succeed gcloud version gardendev/garden-aws-gcloud
+  should_succeed gcloud version gardendev/garden-gcloud
+  should_fail gcloud version gardendev/garden
+  should_fail gcloud version gardendev/garden-azure
+  should_fail gcloud version gardendev/garden-aws
+
+  # Azure
+  should_succeed az version gardendev/garden-aws-gcloud-azure
+  should_succeed az version gardendev/garden-azure
+  should_fail az version gardendev/garden
+  should_fail az version gardendev/garden-gcloud
+  should_fail az version gardendev/garden-aws
+  should_fail az version gardendev/garden-aws-gcloud
+
+TEST "run all binaries"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PATCH_VERSION=0 CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl all
+
+  # garden
+  should_succeed garden --version gardendev/garden-aws-gcloud-azure
+  should_succeed garden --version gardendev/garden-aws-gcloud
+  should_succeed garden --version gardendev/garden-aws
+  should_succeed garden --version gardendev/garden-gcloud
+  should_succeed garden --version gardendev/garden-azure
+  should_succeed garden --version gardendev/garden:acorn-alpine
+  should_succeed garden --version gardendev/garden:acorn-buster
+
+  # aws
+  should_succeed aws --version gardendev/garden-aws-gcloud-azure
+  should_succeed aws --version gardendev/garden-aws-gcloud
+  should_succeed aws --version gardendev/garden-aws
+
+  # Gcloud
+  should_succeed gcloud version gardendev/garden-aws-gcloud-azure
+  should_succeed gcloud version gardendev/garden-aws-gcloud
+  should_succeed gcloud version gardendev/garden-gcloud
+
+  # Azure
+  should_succeed az version gardendev/garden-aws-gcloud-azure
+  should_succeed az version gardendev/garden-azure
+
+TEST "edge tags for buster"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PRERELEASE=edge CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl buster
+
+  should_not_exist gardendev/garden latest
+  should_not_exist gardendev/garden 0.12-buster
+  should_exist gardendev/garden 0.12-edge-buster
+  should_exist gardendev/garden acorn-edge-buster
+
+TEST "edge tags for alpine"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PRERELEASE=edge CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl alpine
+
+  for image in gardendev/garden{,-aws,-azure,-gcloud,-aws-gcloud,-aws-gcloud-azure}
+    do
+    should_not_exist $image latest
+    should_not_exist $image 0.12-alpine
+    should_exist $image 0.12-edge-alpine
+    should_exist $image acorn-edge-alpine
+  done
+
+TEST "prerelease tags for buster"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PATCH_VERSION=0 PRERELEASE=alpha1 CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl buster
+
+  should_not_exist gardendev/garden latest
+  should_not_exist gardendev/garden 0.12-buster
+  should_not_exist gardendev/garden 0.12-alpha1-buster
+  should_not_exist gardendev/garden acorn-alpha1-buster
+  should_exist gardendev/garden 0.12.0-alpha1-buster
+
+TEST "prerelease tags for alpine"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PATCH_VERSION=0 PRERELEASE=alpha1 CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl alpine
+
+  for image in gardendev/garden{,-aws,-azure,-gcloud,-aws-gcloud,-aws-gcloud-azure}
+    do
+    should_not_exist $image latest
+    should_not_exist $image 0.12-alpine
+    should_not_exist $image 0.12-alpha1-alpine
+    should_not_exist $image acorn-alpha1-alpine
+    should_exist gardendev/garden 0.12.0-alpha1-alpine
+  done
+
+TEST "production release tags for buster"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PATCH_VERSION=0 CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl buster
+
+  should_not_exist gardendev/garden latest
+  should_exist gardendev/garden 0.12-buster
+  should_exist gardendev/garden 0.12.0-buster
+  should_exist gardendev/garden acorn-buster
+  should_not_exist gardendev/garden 0.12-edge-buster
+  should_not_exist gardendev/garden acorn-edge-buster
+
+TEST "production release tags for alpine"
+  MAJOR_VERSION=0 MINOR_VERSION=12 PATCH_VERSION=0 CODENAME=acorn \
+    docker buildx bake --progress=plain -f support/docker-bake.hcl alpine
+
+  for image in gardendev/garden{,-aws,-azure,-gcloud,-aws-gcloud,-aws-gcloud-azure}
+    do
+    should_exist $image latest
+    should_exist $image 0.12-alpine
+    should_exist $image 0.12.0-alpine
+    should_exist $image acorn-alpine
+    should_not_exist $image 0.12-edge-alpine
+    should_not_exist $image acorn-edge-alpine
+  done
diff --git a/support/docker-bake.hcl b/support/docker-bake.hcl
new file mode 100644
index 0000000000..ceec59e103
--- /dev/null
+++ b/support/docker-bake.hcl
@@ -0,0 +1,122 @@
+// required
+variable "CODENAME" {
+}
+variable "MINOR_VERSION" {
+}
+variable "MAJOR_VERSION" {
+}
+
+// optional
+variable "PATCH_VERSION" {
+  default = ""
+}
+variable "PRERELEASE" {
+  default = ""
+}
+
+function "isProductionRelease" {
+  params = []
+  result = PRERELEASE == ""
+}
+
+function "isPreRelease" {
+  params = []
+  result = PRERELEASE != "" && PATCH_VERSION != ""
+}
+
+function "isEdgeRelease" {
+  params = []
+  result = PRERELEASE != "" && PATCH_VERSION == ""
+}
+
+// TODO: Remove latest from 0.12/acorn releases, once 0.13/bonsai is GA
+function "withLatest" {
+  params = [tags]
+  result = "${isProductionRelease() ? concat(tags, ["latest"]) : tags}"
+}
+
+function "tags" {
+  params = [flavor]
+  result = [ for tag, condition in
+      {
+        // edge release
+        "${CODENAME}-${PRERELEASE}-${flavor}": isEdgeRelease(),
+        "${MAJOR_VERSION}.${MINOR_VERSION}-${PRERELEASE}-${flavor}": isEdgeRelease(),
+
+        // prerelease version
+        "${MAJOR_VERSION}.${MINOR_VERSION}.${PATCH_VERSION}-${PRERELEASE}-${flavor}": isPreRelease(),
+
+        // production release
+        "${CODENAME}-${flavor}": isProductionRelease(),
+        "${MAJOR_VERSION}.${MINOR_VERSION}-${flavor}": isProductionRelease(),
+        "${MAJOR_VERSION}.${MINOR_VERSION}.${PATCH_VERSION}-${flavor}": isProductionRelease(),
+      }
+    : tag if condition
+  ]
+}
+
+function "repository" {
+  params = [repository, tags]
+  result = [for t in tags : "${repository}:${t}"]
+}
+
+group "all" {
+  targets = ["alpine", "buster"]
+}
+
+target "buster" {
+  dockerfile = "../../support/buster.Dockerfile"
+  target     = "buster-base"
+  platforms  = ["linux/amd64"]
+  context    = "dist/linux-amd64"
+  tags       = repository("gardendev/garden", tags("buster"))
+}
+
+group "alpine" {
+  targets = [
+    "alpine-base",
+    "alpine-aws",
+    "alpine-azure",
+    "alpine-gcloud",
+    "alpine-aws-gcloud",
+    "alpine-aws-gcloud-azure"
+  ]
+}
+
+target "alpine-base" {
+  dockerfile = "../../support/alpine.Dockerfile"
+  target     = "garden-alpine-base"
+  platforms  = ["linux/amd64"]
+  context    = "dist/alpine-amd64"
+  tags       = repository("gardendev/garden", withLatest(tags("alpine")))
+}
+
+target "alpine-aws" {
+  inherits = ["alpine-base"]
+  target   = "garden-aws"
+  tags     = repository("gardendev/garden-aws", withLatest(tags("alpine")))
+}
+
+target "alpine-azure" {
+  inherits = ["alpine-base"]
+  target   = "garden-azure"
+  tags     = repository("gardendev/garden-azure", withLatest(tags("alpine")))
+}
+
+target "alpine-gcloud" {
+  inherits = ["alpine-base"]
+  target   = "garden-gcloud"
+  tags     = repository("gardendev/garden-gcloud", withLatest(tags("alpine")))
+}
+
+target "alpine-aws-gcloud" {
+  inherits = ["alpine-base"]
+  target   = "garden-aws-gcloud"
+  tags     = repository("gardendev/garden-aws-gcloud", withLatest(tags("alpine")))
+}
+
+target "alpine-aws-gcloud-azure" {
+  inherits = ["alpine-base"]
+  target   = "garden-aws-gcloud-azure"
+  tags     = repository("gardendev/garden-aws-gcloud-azure", withLatest(tags("alpine")))
+}
diff --git a/support/full.Dockerfile b/support/full.Dockerfile
deleted file mode 100644
index 0fd3f7050d..0000000000
--- a/support/full.Dockerfile
+++ /dev/null
@@ -1,36 +0,0 @@
-ARG TAG=latest
-FROM gardendev/garden-gcloud:${TAG}
-
-# Required by Azure DevOps to tell the system where node is installed
-LABEL "com.azure.dev.pipelines.agent.handler.node.path"="/usr/local/bin/node"
-
-ENV KUBELOGIN_VERSION=v0.0.9
-
-RUN pip install awscli==1.22.77 --upgrade
-
-RUN curl -o aws-iam-authenticator https://amazon-eks.s3.us-west-2.amazonaws.com/1.15.10/2020-02-22/bin/linux/amd64/aws-iam-authenticator \
-  && chmod +x ./aws-iam-authenticator \
-  && mv ./aws-iam-authenticator /usr/bin/
-
-# Build dependencies
-RUN apk add --virtual=build gcc libffi-dev musl-dev openssl-dev make py3-pip \
-  # Runtime dependency
-  && apk add python3-dev \
-  && pip3 install virtualenv \
-  && python3 -m virtualenv /azure-cli \
-  && /azure-cli/bin/python -m pip --no-cache-dir install azure-cli \
-  && echo "#!/usr/bin/env sh" > /usr/bin/az \
-  && echo '/azure-cli/bin/python -m azure.cli "$@"' >> /usr/bin/az \
-  && chmod +x /usr/bin/az \
-  && wget https://github.com/Azure/kubelogin/releases/download/${KUBELOGIN_VERSION}/kubelogin-linux-amd64.zip \
-  && unzip kubelogin-linux-amd64.zip \
-  && cp bin/linux_amd64/kubelogin /usr/bin/
-
-RUN mkdir -p /opt/ibmcloud \
-  && cd /opt/ibmcloud \
-  && curl -o ibmcloud_installer.tar.gz https://download.clis.cloud.ibm.com/ibm-cloud-cli/2.2.0/IBM_Cloud_CLI_2.2.0_amd64.tar.gz \
-  && tar -zxf ibmcloud_installer.tar.gz \
-  && cd Bluemix_CLI/ \
-  && ./install \
-  && cd $HOME \
-  && ibmcloud plugin install container-service
diff --git a/support/gcloud.Dockerfile b/support/gcloud.Dockerfile
deleted file mode 100644
index a1af11b7fa..0000000000
--- a/support/gcloud.Dockerfile
+++ /dev/null
@@ -1,16 +0,0 @@
-ARG TAG=latest
-FROM google/cloud-sdk:411.0.0-alpine as gcloud
-
-RUN gcloud components install kubectl gke-gcloud-auth-plugin --quiet
-
-FROM gardendev/garden:${TAG}
-
-ENV CLOUDSDK_PYTHON=python3
-
-COPY --from=gcloud /google-cloud-sdk /google-cloud-sdk
-ENV PATH /google-cloud-sdk/bin:$PATH
-
-RUN apk add --no-cache python3 py3-pip libc6-compat py3-openssl gnupg openssh-client py3-crcmod \
-  && ln -s /google-cloud-sdk/bin/* /usr/local/bin/ \
-  && chmod +x /usr/local/bin/* \
-  && gcloud version