stages:
   - container
+  - container-2
   - meson-x86_64
   - scons
   - meson-misc
   needs:
     - x86_build
 
+# Debian 10 based x86 test image base
+x86_test-base:
+  extends: x86_build
+  variables:
+    FDO_DISTRIBUTION_TAG: &x86_test-base "2020-05-23"
+
+.use-x86_test-base:
+  extends:
+    - x86_build
+    - .ci-run-policy
+  stage: container-2
+  variables:
+    BASE_TAG: *x86_test-base
+    FDO_BASE_IMAGE: "$CI_REGISTRY_IMAGE/debian/x86_test-base:$BASE_TAG"
+  needs:
+    - x86_test-base
+
 # Debian 10 based x86 test image for GL
 x86_test-gl:
-  extends: x86_build
+  extends: .use-x86_test-base
   variables:
-    FDO_DISTRIBUTION_TAG: &x86_test-gl "2020-05-18"
+    FDO_DISTRIBUTION_TAG: &x86_test-gl "2020-05-23"
 
 # Debian 10 based x86 test image for VK
 x86_test-vk:
-  extends: x86_build
+  extends: .use-x86_test-base
   variables:
-    FDO_DISTRIBUTION_TAG: &x86_test-vk "2020-05-18"
+    FDO_DISTRIBUTION_TAG: &x86_test-vk "2020-05-23"
 
 # Debian 9 based x86 build image (old LLVM)
 x86_build_old:
   needs:
     - x86_build
     - meson-testing
+    - x86_test-base
     - x86_test-gl
 
 .test-vk:
   needs:
     - x86_build
     - meson-testing
+    - x86_test-base
     - x86_test-vk
 
 .piglit-test:
 
--- /dev/null
+#!/bin/bash
+
+set -e
+set -o xtrace
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get install -y \
+      ca-certificates \
+      gnupg
+
+# Upstream LLVM package repository
+apt-key add .gitlab-ci/container/llvm-snapshot.gpg.key
+echo "deb https://apt.llvm.org/buster/ llvm-toolchain-buster-9 main" >/etc/apt/sources.list.d/llvm9.list
+
+sed -i -e 's/http:\/\/deb/https:\/\/deb/g' /etc/apt/sources.list
+echo 'deb https://deb.debian.org/debian testing main' >/etc/apt/sources.list.d/testing.list
+
+apt-get update
+
+# Don't use newer packages from testing by default
+cat >/etc/apt/preferences <<EOF
+Package: *
+Pin: release a=testing
+Pin-Priority: 100
+EOF
+
+apt-get dist-upgrade -y
+
+apt-get install -y --no-remove \
+      git \
+      git-lfs \
+      libexpat1 \
+      libllvm9 \
+      liblz4-1 \
+      libpcre32-3 \
+      libpng16-16 \
+      libpython3.7 \
+      libvulkan1 \
+      libwayland-client0 \
+      libwayland-server0 \
+      libxcb-ewmh2 \
+      libxcb-randr0 \
+      libxcb-keysyms1 \
+      libxcb-xfixes0 \
+      libxkbcommon0 \
+      libxrandr2 \
+      libxrender1 \
+      python \
+      python3-mako \
+      python3-numpy \
+      python3-pil \
+      python3-pytest \
+      python3-requests \
+      python3-six \
+      python3-yaml \
+      python3.7 \
+      qt5-default \
+      qt5-qmake \
+      vulkan-tools \
+      waffle-utils \
+      xauth \
+      xvfb \
+      zlib1g
+
+apt-get purge -y \
+      gnupg
+
+apt-get autoremove -y --purge
 
 
 export DEBIAN_FRONTEND=noninteractive
 
-apt-get install -y \
-      ca-certificates \
-      gnupg
-
-# Upstream LLVM package repository
-apt-key add .gitlab-ci/container/llvm-snapshot.gpg.key
-echo "deb https://apt.llvm.org/buster/ llvm-toolchain-buster-9 main" >/etc/apt/sources.list.d/llvm9.list
-
-sed -i -e 's/http:\/\/deb/https:\/\/deb/g' /etc/apt/sources.list
-echo 'deb https://deb.debian.org/debian testing main' >/etc/apt/sources.list.d/testing.list
-
-apt-get update
-
-# Don't use newer packages from testing by default
-cat >/etc/apt/preferences <<EOF
-Package: *
-Pin: release a=testing
-Pin-Priority: 100
-EOF
-
-apt-get dist-upgrade -y
-
-apt-get install -y --no-remove \
+# Ephemeral packages (installed for this script and removed again at the end)
+STABLE_EPHEMERAL=" \
       autoconf \
       automake \
       ccache \
       cmake \
       g++ \
       gcc \
-      git \
-      libexpat1 \
       libgbm-dev \
       libgles2-mesa-dev \
-      libllvm9 \
       libpcre3-dev \
-      libpcre32-3 \
       libpng-dev \
-      libpng16-16 \
-      libpython3.7 \
       libvulkan-dev \
-      libvulkan1 \
       libwaffle-dev \
-      libwayland-server0 \
-      libxcb-keysyms1 \
       libxcb-keysyms1-dev \
-      libxcb-xfixes0 \
       libxkbcommon-dev \
-      libxkbcommon0 \
       libxrender-dev \
-      libxrender1 \
       make \
       meson \
       patch \
       pkg-config \
-      python \
       python3-distutils \
-      python3-mako \
-      python3-numpy \
-      python3-pil \
-      python3-pytest \
-      python3-requests \
-      python3-six \
-      python3-yaml \
-      python3.7 \
       python3.7-dev \
-      qt5-default \
-      qt5-qmake \
-      waffle-utils \
       wget \
-      xauth \
-      xvfb \
       xz-utils \
-      zlib1g
+      "
+
+TESTING_EPHEMERAL=" \
+      libc6-dev \
+      "
+
+apt-get update
+
+apt-get install -y --no-remove \
+      $STABLE_EPHEMERAL
 
 # Install packages we need from Debian testing last, to avoid pulling in more
 apt-get install -y -t testing \
-      libc6-dev
+      $TESTING_EPHEMERAL
 
 
 . .gitlab-ci/container/container_pre_build.sh
 ccache --show-stats
 
 apt-get purge -y \
-      autoconf \
-      automake \
-      ccache \
-      cmake \
-      g++ \
-      gcc \
-      gnupg \
-      libc6-dev \
-      libgbm-dev \
-      libgles2-mesa-dev \
-      libpcre3-dev \
-      libpng-dev \
-      libwaffle-dev \
-      libxcb-keysyms1-dev \
-      libxkbcommon-dev \
-      libxrender-dev \
-      make \
-      meson \
-      patch \
-      pkg-config \
-      python3-distutils \
-      python3.7-dev \
-      wget \
-      xz-utils
+      $STABLE_EPHEMERAL \
+      $TESTING_EPHEMERAL
 
 apt-get autoremove -y --purge
 
 
 export DEBIAN_FRONTEND=noninteractive
 
-apt-get install -y \
-      ca-certificates \
-      gnupg
-
-# Upstream LLVM package repository
-apt-key add .gitlab-ci/container/llvm-snapshot.gpg.key
-echo "deb https://apt.llvm.org/buster/ llvm-toolchain-buster-9 main" >/etc/apt/sources.list.d/llvm9.list
-
-sed -i -e 's/http:\/\/deb/https:\/\/deb/g' /etc/apt/sources.list
-echo 'deb https://deb.debian.org/debian testing main' >/etc/apt/sources.list.d/testing.list
-
-apt-get update
-
-# Don't use newer packages from testing by default
-cat >/etc/apt/preferences <<EOF
-Package: *
-Pin: release a=testing
-Pin-Priority: 100
-EOF
-
-apt-get dist-upgrade -y
-
-apt-get install -y --no-remove \
+# Ephemeral packages (installed for this script and removed again at the end)
+STABLE_EPHEMERAL=" \
       ccache \
       cmake \
       g++ \
       gcc \
-      git \
-      git-lfs \
-      libexpat1 \
       libgbm-dev \
       libgles2-mesa-dev \
-      libllvm9 \
-      liblz4-1 \
       liblz4-dev \
       libpng-dev \
-      libpng16-16 \
       libvulkan-dev \
-      libvulkan1 \
-      libwayland-client0 \
-      libwayland-server0 \
       libxcb-ewmh-dev \
-      libxcb-ewmh2 \
-      libxcb-keysyms1 \
       libxcb-keysyms1-dev \
-      libxcb-randr0 \
-      libxcb-xfixes0 \
       libxkbcommon-dev \
-      libxkbcommon0 \
       libxrandr-dev \
-      libxrandr2 \
       libxrender-dev \
-      libxrender1 \
       meson \
       p7zip \
       pkg-config \
-      python \
       python3-distutils \
-      python3-pil \
-      python3-pytest \
-      python3-requests \
-      python3-yaml \
-      vulkan-tools \
       wget \
-      xauth \
-      xvfb
+      "
+
+TESTING_EPHEMERAL=" \
+      libc6-dev \
+      "
+
+apt-get update
 
-# We need multiarch for Wine
+apt-get install -y --no-remove \
+      $STABLE_EPHEMERAL
+
+        # We need multiarch for Wine
 dpkg --add-architecture i386
 
 apt-get update
 
 # Install packages we need from Debian testing last, to avoid pulling in more
 apt-get install -y -t testing \
-      libc6-dev
+      $TESTING_EPHEMERAL
 
 
 ############### Set up Wine env variables
 ccache --show-stats
 
 apt-get purge -y \
-      ccache \
-      cmake \
-      g++ \
-      gcc \
-      gnupg \
-      libgbm-dev \
-      libgles2-mesa-dev \
-      liblz4-dev \
-      libpng-dev \
-      libvulkan-dev \
-      libxcb-ewmh-dev \
-      libxcb-keysyms1-dev \
-      libxkbcommon-dev \
-      libxrandr-dev \
-      libxrender-dev \
-      meson \
-      p7zip \
-      pkg-config \
-      wget
+      $STABLE_EPHEMERAL \
+      $TESTING_EPHEMERAL
 
 apt-get autoremove -y --purge