diff --git a/.gitignore b/.gitignore
index 8a6dc5a..e8994b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,7 @@
 *.zip
 
 # ruby
+.bundle/cache
 vendor/
 .rspec_status
 *.json
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..696a65c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,6 @@
+FROM public.ecr.aws/lambda/ruby
+RUN dnf install -y gcc
+ENV BUNDLE_SILENCE_ROOT_WARNING=1
+VOLUME /root/.bundle
+VOLUME /var/task
+ENTRYPOINT ["bundle"]
diff --git a/Makefile b/Makefile
index 4167660..54d0909 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
-GEMFILES  ?= $(shell find . -name Gemfile -maxdepth 5 | sort)
-LOCKFILES ?= $(foreach GEMFILE,$(GEMFILES),$(GEMFILE).lock)
+GEMFILES  ?= $(shell git ls-tree -r --name-only @ | grep Gemfile$)
+LOCKFILES ?= $(shell git ls-tree -r --name-only @ | grep Gemfile.lock$)
 
 .PHONY: blue build clean global logs
 
@@ -7,6 +7,7 @@ blue:
 	terraform -chdir=$@ apply
 
 build: $(LOCKFILES)
+	docker compose down --rmi local
 
 clean:
 	find . -type d -name vendor | xargs rm -rf
@@ -18,5 +19,5 @@ logs:
 	aws logs tail --follow $(shell aws logs describe-log-groups | jq -r '.logGroups[].logGroupName' | grep brutalismbot | fzf --no-info --reverse --sync --height 10%)
 
 $(LOCKFILES): %.lock: % .ruby-version
-	BUNDLE_APP_CONFIG=$(PWD)/.bundle BUNDLE_GEMFILE=$< bundle update
-	BUNDLE_APP_CONFIG=$(PWD)/.bundle BUNDLE_GEMFILE=$< bundle install
+	BUNDLE=$(shell dirname $<) docker compose run --rm build update
+	BUNDLE=$(shell dirname $<) docker compose run --rm build install
diff --git a/compose.yml b/compose.yml
new file mode 100644
index 0000000..033dfcd
--- /dev/null
+++ b/compose.yml
@@ -0,0 +1,7 @@
+---
+services:
+  build:
+    build: .
+    volumes:
+      - ./.bundle:/root/.bundle
+      - ./${BUNDLE:-}:/var/task