diff --git a/ci-automation/ci-config.env b/ci-automation/ci-config.env
index 18bf88f4c8..91833b0a87 100644
--- a/ci-automation/ci-config.env
+++ b/ci-automation/ci-config.env
@@ -17,8 +17,10 @@ CONTAINER_REGISTRY="ghcr.io/flatcar-linux"
 
 GC_BUCKET="flatcar-linux"
 
-# No PIGZ on Flatcar
-PIGZ="docker run --rm -i ghcr.io/flatcar-linux/pigz --fast"
+if ! command -v pigz > /dev/null; then
+  # No PIGZ on Flatcar
+  PIGZ="docker run --rm -i ghcr.io/flatcar-linux/pigz --fast"
+fi
 
 CI_GIT_AUTHOR="flatcar-ci"
 CI_GIT_EMAIL="infra+ci@flatcar-linux.org"
diff --git a/ci-automation/ci_automation_common.sh b/ci-automation/ci_automation_common.sh
index 181821ad92..dccd941000 100644
--- a/ci-automation/ci_automation_common.sh
+++ b/ci-automation/ci_automation_common.sh
@@ -8,6 +8,7 @@
 
 source ci-automation/ci-config.env
 : ${PIGZ:=pigz}
+: ${docker:=docker}
 
 function init_submodules() {
     git submodule init
@@ -136,7 +137,7 @@ function image_exists_locally() {
     local version="$2"
     local image="${name}:${version}"
 
-    local image_exists="$(docker images "${image}" \
+    local image_exists="$($docker images "${image}" \
                             --no-trunc --format '{{.Repository}}:{{.Tag}}')"
 
     [ "${image}" = "${image_exists}" ]
@@ -157,7 +158,7 @@ function docker_image_fullname() {
     local image="$1"
     local version="$2"
 
-    docker images --no-trunc --format '{{.Repository}}:{{.Tag}}' \
+    $docker images --no-trunc --format '{{.Repository}}:{{.Tag}}' \
         | grep -E "^(${CONTAINER_REGISTRY}/)*${image}:${version}$"
 }
 # --
@@ -169,7 +170,7 @@ function docker_image_to_buildcache() {
     # strip potential container registry prefix
     local tarball="$(basename "$image")-${version}.tar.gz"
 
-    docker save "${image}":"${version}" | $PIGZ -c > "${tarball}"
+    $docker save "${image}":"${version}" | $PIGZ -c > "${tarball}"
     copy_to_buildcache "containers/${version}" "${tarball}"
 }
 # --
@@ -179,7 +180,7 @@ function docker_commit_to_buildcache() {
     local image_name="$2"
     local image_version="$3"
 
-    docker commit "${container}" "${image_name}:${image_version}"
+    $docker commit "${container}" "${image_name}:${image_version}"
     docker_image_to_buildcache "${image_name}" "${image_version}"
 }
 # --
@@ -199,7 +200,7 @@ function docker_image_from_buildcache() {
         --retry-connrefused --retry-max-time 60 --connect-timeout 20 \
         --remote-name "${url}"
 
-    cat "${tgz}" | $PIGZ -d -c | docker load
+    cat "${tgz}" | $PIGZ -d -c | $docker load
 
     rm "${tgz}"
 }
@@ -213,10 +214,11 @@ function docker_image_from_registry_or_buildcache() {
         return
     fi
 
-    if docker pull "${CONTAINER_REGISTRY}/${image}:${version}" ; then
+    if $docker pull "${CONTAINER_REGISTRY}/${image}:${version}" ; then
         return
     fi
 
+    echo "Falling back to tar ball download..." >&2
     docker_image_from_buildcache "${image}" "${version}"
 }
 # --
diff --git a/run_sdk_container b/run_sdk_container
index 225a2cdf91..d698f5d1f3 100755
--- a/run_sdk_container
+++ b/run_sdk_container
@@ -4,7 +4,7 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-set -eu
+set -euo pipefail
 
 cd $(dirname "$0")
 source sdk_lib/sdk_container_common.sh
@@ -104,6 +104,9 @@ if [ -z "$stat" ] ; then
 
     gpg_volumes=$(gnupg_ssh_gcloud_mount_opts)
 
+    source ci-automation/ci_automation_common.sh
+    docker_image_from_registry_or_buildcache "flatcar-sdk-${arch}" "${docker_sdk_vernum}"
+
     $docker create $tty -i \
        -v /dev:/dev \
        -v "$(pwd)/sdk_container:/mnt/host/source/" \