diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 03e81047f7..d785d26f78 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,13 +11,16 @@ on:
   pull_request:
 
 jobs:
-  build:
+  pkg:
     runs-on: ubuntu-20.04
     strategy:
       fail-fast: false
       matrix:
         target:
           - debian-bullseye
+          - ubuntu-jammy
+          - centos-7
+          - fedora-36
     steps:
       -
         name: Checkout
@@ -29,3 +32,48 @@ jobs:
         name: Build
         run: |
           make ${{ matrix.target }}
+
+  static:
+    runs-on: ubuntu-20.04
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm/v6
+          - linux/arm/v7
+          - linux/arm64
+          - darwin/amd64
+          - darwin/arm64
+          - windows/amd64
+    steps:
+      -
+        name: Prepare
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Build
+        run: |
+          make TARGETPLATFORM=${{ matrix.platform }} static
+      -
+        name: List files
+        run: |
+          tree -nh ./static/build
+      -
+        name: Upload static bundle
+        uses: actions/upload-artifact@v2
+        with:
+          name: static-${{ env.PLATFORM_PAIR }}
+          path: static/build/*.tar.gz
+          if-no-files-found: error
+          retention-days: 7
diff --git a/Jenkinsfile b/Jenkinsfile
index e96a994427..9672d74bad 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -1,7 +1,5 @@
 #!groovy
 
-def branch = env.CHANGE_TARGET ?: env.BRANCH_NAME
-
 def pkgs = [
     [target: "centos-7",                 image: "centos:7",                               arches: ["amd64", "aarch64"]],          // (EOL: June 30, 2024)
     [target: "centos-8",                 image: "quay.io/centos/centos:stream8",          arches: ["amd64", "aarch64"]],
@@ -19,15 +17,16 @@ def pkgs = [
     [target: "ubuntu-jammy",             image: "ubuntu:jammy",                           arches: ["amd64", "aarch64", "armhf"]], // Ubuntu 22.04 LTS (End of support: April, 2027. EOL: April, 2032)
 ]
 
-def genBuildStep(LinkedHashMap pkg, String arch) {
+def statics = [
+    [os: "linux",       arches: ["amd64", "armv6", "armv7", "aarch64"]],
+    [os: "darwin",      arches: ["amd64", "aarch64"]],
+    [os: "windows",     arches: ["amd64"]],
+]
+
+def genPkgStep(LinkedHashMap pkg, String arch) {
     def nodeLabel = "linux&&${arch}"
-    def platform = ""
     def branch = env.CHANGE_TARGET ?: env.BRANCH_NAME
-
     if (arch == 'armhf') {
-        // Running armhf builds on EC2 requires --platform parameter
-        // Otherwise it accidentally pulls armel images which then breaks the verify step
-        platform = "--platform=linux/${arch}"
         nodeLabel = "${nodeLabel}&&ubuntu"
     } else {
         nodeLabel = "${nodeLabel}&&ubuntu-2004"
@@ -42,6 +41,7 @@ def genBuildStep(LinkedHashMap pkg, String arch) {
             stage("info") {
                 sh 'docker version'
                 sh 'docker info'
+                sh 'env|sort'
             }
             stage("build") {
                 checkout scm
@@ -55,52 +55,29 @@ def genBuildStep(LinkedHashMap pkg, String arch) {
     }
 }
 
-def build_package_steps = [
-    'static-linux': { ->
-        wrappedNode(label: 'ubuntu-2004 && x86_64', cleanWorkspace: true) {
-            stage("static-linux") {
-                // This is just a "dummy" stage to make the distro/arch visible
-                // in Jenkins' BlueOcean view, which truncates names....
-                sh 'echo starting...'
-            }
-            stage("info") {
-                sh 'docker version'
-                sh 'docker info'
-            }
-            stage("build") {
-                try {
-                    checkout scm
-                    sh "make REF=$branch DOCKER_BUILD_PKGS='static-linux' static"
-                } finally {
-                    sh "make clean"
-                }
-            }
-        }
-    },
-    'cross-mac': { ->
-        wrappedNode(label: 'ubuntu-2004 && x86_64', cleanWorkspace: true) {
-            stage("cross-mac") {
-                // This is just a "dummy" stage to make the distro/arch visible
-                // in Jenkins' BlueOcean view, which truncates names....
-                sh 'echo starting...'
-            }
-            stage("info") {
-                sh 'docker version'
-                sh 'docker info'
-            }
-            stage("build") {
-                try {
-                    checkout scm
-                    sh "make REF=$branch DOCKER_BUILD_PKGS='cross-mac' static"
-                } finally {
-                    sh "make clean"
-                }
-            }
-        }
-    },
-    'cross-win': { ->
-        wrappedNode(label: 'ubuntu-2004 && x86_64', cleanWorkspace: true) {
-            stage("cross-win") {
+def genPkgSteps(opts) {
+    return opts.arches.collectEntries {
+        ["${opts.image}-${it}": genPkgStep(opts, it)]
+    }
+}
+
+def genStaticStep(LinkedHashMap pkg, String arch) {
+    def config = [
+        amd64:   [label: "x86_64",      targetarch: "amd64"],
+        aarch64: [label: "aarch64",     targetarch: "arm64"],
+        armv6:   [label: "aarch64",     targetarch: "arm/v6"],
+        armv7:   [label: "aarch64",     targetarch: "arm/v7"],
+        ppc64le: [label: "ppc64le",     targetarch: "ppc64le"],
+        s390x  : [label: "s390x",       targetarch: "s390x"],
+    ][arch]
+    def nodeLabel = "linux&&${config.label}"
+    if (config.label == 'x86_64') {
+        nodeLabel = "${nodeLabel}&&ubuntu"
+    }
+    def branch = env.CHANGE_TARGET ?: env.BRANCH_NAME
+    return { ->
+        wrappedNode(label: nodeLabel, cleanWorkspace: true) {
+            stage("static-${pkg.os}-${arch}") {
                 // This is just a "dummy" stage to make the distro/arch visible
                 // in Jenkins' BlueOcean view, which truncates names....
                 sh 'echo starting...'
@@ -108,25 +85,27 @@ def build_package_steps = [
             stage("info") {
                 sh 'docker version'
                 sh 'docker info'
+                sh 'env|sort'
             }
             stage("build") {
                 try {
                     checkout scm
-                    sh "make REF=$branch DOCKER_BUILD_PKGS='cross-win' static"
+                    sh "make REF=$branch TARGETPLATFORM=${pkg.os}/${config.targetarch} static"
                 } finally {
                     sh "make clean"
                 }
             }
         }
-    },
-]
+    }
+}
 
-def genPackageSteps(opts) {
+def genStaticSteps(opts) {
     return opts.arches.collectEntries {
-        ["${opts.image}-${it}": genBuildStep(opts, it)]
+        ["static-${opts.os}-${it}": genStaticStep(opts, it)]
     }
 }
 
-build_package_steps << pkgs.collectEntries { genPackageSteps(it) }
+def parallelStages = pkgs.collectEntries { genPkgSteps(it) }
+parallelStages << statics.collectEntries { genStaticSteps(it) }
 
-parallel(build_package_steps)
+parallel(parallelStages)
diff --git a/Makefile b/Makefile
index 80cdae1386..aab971117c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,5 @@
 include common.mk
 
-STATIC_VERSION=$(shell static/gen-static-ver $(realpath $(CURDIR)/src/github.com/docker/docker) $(VERSION))
-
 # Taken from: https://www.cmcrossroads.com/article/printing-value-makefile-variable
 print-%  : ; @echo $($*)
 
@@ -11,68 +9,89 @@ help: ## show make targets
 
 .PHONY: clean-src
 clean-src:
-	[ ! -d src ] || $(CHOWN) -R $(shell id -u):$(shell id -g) src
-	$(RM) -r src
+	@[ ! -d src ] || $(CHOWN) -R $(shell id -u):$(shell id -g) src
+	@$(RM) -r src
 
 .PHONY: src
 src: src/github.com/docker/cli src/github.com/docker/docker src/github.com/docker/buildx src/github.com/docker/compose src/github.com/docker/scan-cli-plugin ## clone source
 
 ifdef CLI_DIR
 src/github.com/docker/cli:
+	$(call title,Copying $(CLI_DIR))
 	mkdir -p "$(@D)"
 	cp -r "$(CLI_DIR)" $@
 else
 src/github.com/docker/cli:
+	$(call title,Init $(DOCKER_CLI_REPO))
 	git init $@
 	git -C $@ remote add origin "$(DOCKER_CLI_REPO)"
 endif
 
 ifdef ENGINE_DIR
 src/github.com/docker/docker:
+	$(call title,Copying $(ENGINE_DIR))
 	mkdir -p "$(@D)"
 	cp -r "$(ENGINE_DIR)" $@
 else
 src/github.com/docker/docker:
+	$(call title,Init $(DOCKER_ENGINE_REPO))
 	git init $@
 	git -C $@ remote add origin "$(DOCKER_ENGINE_REPO)"
 endif
 
 src/github.com/docker/buildx:
+	$(call title,Init $(DOCKER_BUILDX_REPO))
 	git init $@
 	git -C $@ remote add origin "$(DOCKER_BUILDX_REPO)"
 
 src/github.com/docker/compose:
+	$(call title,Init $(DOCKER_COMPOSE_REPO))
 	git init $@
 	git -C $@ remote add origin "$(DOCKER_COMPOSE_REPO)"
 
 src/github.com/docker/scan-cli-plugin:
+	$(call title,Init $(DOCKER_SCAN_REPO))
 	git init $@
 	git -C $@ remote add origin "$(DOCKER_SCAN_REPO)"
 
+src/github.com/tonistiigi/xx:
+	$(call title,Init $(XX_REPO))
+	git init $@
+	git -C $@ remote add origin "$(XX_REPO)"
 
 .PHONY: checkout-cli
 checkout-cli: src/github.com/docker/cli
+	$(call title,Checkout $(DOCKER_CLI_REPO)#$(DOCKER_CLI_REF))
 	./scripts/checkout.sh src/github.com/docker/cli "$(DOCKER_CLI_REF)"
 
 .PHONY: checkout-docker
 checkout-docker: src/github.com/docker/docker
+	$(call title,Checkout $(DOCKER_ENGINE_REPO)#$(DOCKER_ENGINE_REF))
 	./scripts/checkout.sh src/github.com/docker/docker "$(DOCKER_ENGINE_REF)"
 
 .PHONY: checkout-buildx
 checkout-buildx: src/github.com/docker/buildx
+	$(call title,Checkout $(DOCKER_BUILDX_REPO)#$(DOCKER_BUILDX_REF))
 	./scripts/checkout.sh src/github.com/docker/buildx "$(DOCKER_BUILDX_REF)"
 
 .PHONY: checkout-compose
 checkout-compose: src/github.com/docker/compose
+	$(call title,Checkout $(DOCKER_COMPOSE_REPO)#$(DOCKER_COMPOSE_REF))
 	./scripts/checkout.sh src/github.com/docker/compose "$(DOCKER_COMPOSE_REF)"
 
 .PHONY: checkout-scan-cli-plugin
 checkout-scan-cli-plugin: src/github.com/docker/scan-cli-plugin
+	$(call title,Checkout $(DOCKER_SCAN_REPO)#$(DOCKER_SCAN_REF))
 	./scripts/checkout.sh src/github.com/docker/scan-cli-plugin "$(DOCKER_SCAN_REF)"
 
 .PHONY: checkout
 checkout: checkout-cli checkout-docker checkout-buildx checkout-compose checkout-scan-cli-plugin ## checkout source at the given reference(s)
 
+.PHONY: checkout-xx
+checkout-xx: src/github.com/tonistiigi/xx
+	$(call title,Checkout $(XX_REPO)#$(XX_REF))
+	./scripts/checkout.sh src/github.com/tonistiigi/xx "$(XX_REF)"
+
 .PHONY: clean
 clean: clean-src ## remove build artifacts
 	$(MAKE) -C rpm clean
@@ -81,22 +100,19 @@ clean: clean-src ## remove build artifacts
 
 .PHONY: deb rpm
 deb rpm: checkout ## build rpm/deb packages
-	$(MAKE) -C $@ VERSION=$(VERSION) GO_VERSION=$(GO_VERSION) $@
+	$(MAKE) -C $@ $@
 
 .PHONY: centos-% fedora-% rhel-%
 centos-% fedora-% rhel-%: checkout ## build rpm packages for the specified distro
-	$(MAKE) -C rpm VERSION=$(VERSION) GO_VERSION=$(GO_VERSION) $@
+	$(MAKE) -C rpm $@
 
 .PHONY: debian-% raspbian-% ubuntu-%
 debian-% raspbian-% ubuntu-%: checkout ## build deb packages for the specified distro
-	$(MAKE) -C deb VERSION=$(VERSION) GO_VERSION=$(GO_VERSION) $@
+	$(MAKE) -C deb $@
 
 .PHONY: static
-static: DOCKER_BUILD_PKGS:=static-linux cross-mac cross-win cross-arm
-static: checkout ## build static-compiled packages
-	for p in $(DOCKER_BUILD_PKGS); do \
-		$(MAKE) -C $@ VERSION=$(VERSION) GO_VERSION=$(GO_VERSION) TARGETPLATFORM=$(TARGETPLATFORM) CONTAINERD_VERSION=$(CONTAINERD_VERSION) RUNC_VERSION=$(RUNC_VERSION) $${p}; \
-	done
+static: checkout checkout-xx ## build static package
+	$(MAKE) -C static build
 
 .PHONY: verify
 verify: ## verify installation of packages
diff --git a/common.mk b/common.mk
index fd7213b294..4377fb3e56 100644
--- a/common.mk
+++ b/common.mk
@@ -16,7 +16,7 @@ BUILDTIME=$(shell date -u -d "@$${SOURCE_DATE_EPOCH:-$$(date +%s)}" --rfc-3339 n
 CHOWN:=docker run --rm -v $(CURDIR):/v -w /v alpine chown
 DEFAULT_PRODUCT_LICENSE:=Community Engine
 PACKAGER_NAME?=
-DOCKER_GITCOMMIT:=abcdefg
+GITCOMMIT:=abcdefg
 GO_VERSION:=1.18.4
 PLATFORM=Docker Engine - Community
 SHELL:=/bin/bash
@@ -25,7 +25,8 @@ VERSION?=0.0.1-dev
 # DOCKER_CLI_REPO and DOCKER_ENGINE_REPO define the source repositories to clone
 # the source from. These can be overridden to build from a fork.
 DOCKER_CLI_REPO     ?= https://github.com/docker/cli.git
-DOCKER_ENGINE_REPO  ?= https://github.com/docker/docker.git
+#DOCKER_ENGINE_REPO  ?= https://github.com/docker/docker.git
+DOCKER_ENGINE_REPO  ?= https://github.com/crazy-max/moby.git
 DOCKER_SCAN_REPO    ?= https://github.com/docker/scan-cli-plugin.git
 DOCKER_COMPOSE_REPO ?= https://github.com/docker/compose.git
 DOCKER_BUILDX_REPO  ?= https://github.com/docker/buildx.git
@@ -38,11 +39,16 @@ DOCKER_BUILDX_REPO  ?= https://github.com/docker/buildx.git
 # For other situations, specify DOCKER_CLI_REF and/or DOCKER_ENGINE_REF separately.
 REF                ?= HEAD
 DOCKER_CLI_REF     ?= $(REF)
-DOCKER_ENGINE_REF  ?= $(REF)
+#DOCKER_ENGINE_REF  ?= $(REF)
+DOCKER_ENGINE_REF  ?= cross
 DOCKER_SCAN_REF    ?= v0.17.0
 DOCKER_COMPOSE_REF ?= v2.6.1
 DOCKER_BUILDX_REF  ?= v0.8.2
 
+# XX is used as cross-compilation helper for static bundles
+XX_REPO ?= https://github.com/tonistiigi/xx.git
+XX_REF  ?= v1.1.1
+
 # Use "stage" to install dependencies from download-stage.docker.com during the
 # verify step. Leave empty or use any other value to install from download.docker.com
 VERIFY_PACKAGE_REPO ?= staging
@@ -50,7 +56,40 @@ VERIFY_PACKAGE_REPO ?= staging
 # Optional flags like --platform=linux/armhf
 VERIFY_PLATFORM ?=
 
+# Export vars as envs
 export BUILDTIME
 export DEFAULT_PRODUCT_LICENSE
 export PACKAGER_NAME
 export PLATFORM
+export VERSION
+export GO_VERSION
+
+export DOCKER_CLI_REPO
+export DOCKER_ENGINE_REPO
+export DOCKER_SCAN_REPO
+export DOCKER_COMPOSE_REPO
+export DOCKER_BUILDX_REPO
+
+export REF
+export DOCKER_CLI_REF
+export DOCKER_ENGINE_REF
+export DOCKER_SCAN_REF
+export DOCKER_COMPOSE_REF
+export DOCKER_BUILDX_REF
+
+# utilities
+BOLD := $(shell tput -T linux bold)
+RED := $(shell tput -T linux setaf 1)
+GREEN := $(shell tput -T linux setaf 2)
+YELLOW := $(shell tput -T linux setaf 3)
+BLUE := $(shell tput -T linux setaf 4)
+PURPLE := $(shell tput -T linux setaf 5)
+CYAN := $(shell tput -T linux setaf 6)
+
+RESET := $(shell tput -T linux sgr0)
+TITLE := $(BOLD)$(YELLOW)
+SUCCESS := $(BOLD)$(GREEN)
+
+define title
+    @printf '$(TITLE)$(1)$(RESET)\n'
+endef
diff --git a/deb/common/rules b/deb/common/rules
index 9b495e9388..cfccdd0267 100755
--- a/deb/common/rules
+++ b/deb/common/rules
@@ -10,9 +10,9 @@ override_dh_builddeb:
 
 override_dh_auto_build:
 	# Build the daemon and dependencies
-	cd engine && DOCKER_GITCOMMIT=$(ENGINE_GITCOMMIT) PRODUCT=docker ./hack/make.sh dynbinary
-	cd engine && TMP_GOPATH="/go" hack/dockerfile/install/install.sh tini
-	cd engine && TMP_GOPATH="/go" hack/dockerfile/install/install.sh rootlesskit dynamic
+	cd /go/src/github.com/docker/docker && GITCOMMIT=$(ENGINE_GITCOMMIT) PRODUCT=docker ./hack/make.sh dynbinary
+	cd /go/src/github.com/docker/docker && TMP_GOPATH="/go" hack/dockerfile/install/install.sh tini
+	cd /go/src/github.com/docker/docker && TMP_GOPATH="/go" hack/dockerfile/install/install.sh rootlesskit dynamic
 	# Build the CLI
 	cd /go/src/github.com/docker/cli && VERSION=$(VERSION) GITCOMMIT=$(CLI_GITCOMMIT) LDFLAGS='' GO_LINKMODE=dynamic ./scripts/build/binary && DISABLE_WARN_OUTSIDE_CONTAINER=1 LDFLAGS='' make manpages
 
@@ -40,7 +40,7 @@ override_dh_auto_build:
 	fi
 
 override_dh_auto_test:
-	ver="$$(engine/bundles/dynbinary-daemon/dockerd --version)"; \
+	ver="$$(engine/bundles/dynbinary/dockerd --version)"; \
 		test "$$ver" = "Docker version $(VERSION), build $(ENGINE_GITCOMMIT)" && echo "PASS: daemon version OK" || (echo "FAIL: daemon version ($$ver) did not match" && exit 1)
 
 	ver="$$(cli/build/docker --version)"; \
@@ -71,8 +71,8 @@ override_dh_auto_install:
 	# docker-ce install
 	install -D -m 0644 engine/contrib/init/systemd/docker.service debian/docker-ce/lib/systemd/system/docker.service
 	install -D -m 0644 engine/contrib/init/systemd/docker.socket debian/docker-ce/lib/systemd/system/docker.socket
-	install -D -m 0755 $(shell readlink -e engine/bundles/dynbinary-daemon/dockerd) debian/docker-ce/usr/bin/dockerd
-	install -D -m 0755 $(shell readlink -e engine/bundles/dynbinary-daemon/docker-proxy) debian/docker-ce/usr/bin/docker-proxy
+	install -D -m 0755 $(shell readlink -e engine/bundles/dynbinary/dockerd) debian/docker-ce/usr/bin/dockerd
+	install -D -m 0755 $(shell readlink -e engine/bundles/dynbinary/docker-proxy) debian/docker-ce/usr/bin/docker-proxy
 	install -D -m 0755 /usr/local/bin/docker-init debian/docker-ce/usr/bin/docker-init
 
 	# docker-buildx-plugin install
diff --git a/rpm/SPECS/docker-ce-rootless-extras.spec b/rpm/SPECS/docker-ce-rootless-extras.spec
index b29c66745a..124ca55c31 100644
--- a/rpm/SPECS/docker-ce-rootless-extras.spec
+++ b/rpm/SPECS/docker-ce-rootless-extras.spec
@@ -36,7 +36,7 @@ Either VPNKit or slirp4netns (>= 0.4.0) needs to be installed separately.
 
 %build
 
-export DOCKER_GITCOMMIT=%{_gitcommit_engine}
+export GITCOMMIT=%{_gitcommit_engine}
 mkdir -p /go/src/github.com/docker
 ln -snf ${RPM_BUILD_DIR}/src/engine /go/src/github.com/docker/docker
 TMP_GOPATH="/go" ${RPM_BUILD_DIR}/src/engine/hack/dockerfile/install/install.sh rootlesskit dynamic
diff --git a/rpm/SPECS/docker-ce.spec b/rpm/SPECS/docker-ce.spec
index 6352f7b1bb..45128fd1a7 100644
--- a/rpm/SPECS/docker-ce.spec
+++ b/rpm/SPECS/docker-ce.spec
@@ -80,22 +80,22 @@ depending on a particular stack or provider.
 
 %build
 
-export DOCKER_GITCOMMIT=%{_gitcommit_engine}
+export GITCOMMIT=%{_gitcommit_engine}
 mkdir -p /go/src/github.com/docker
 ln -snf ${RPM_BUILD_DIR}/src/engine /go/src/github.com/docker/docker
 
-pushd ${RPM_BUILD_DIR}/src/engine
+pushd /go/src/github.com/docker/docker
 TMP_GOPATH="/go" hack/dockerfile/install/install.sh tini
 VERSION=%{_origversion} PRODUCT=docker hack/make.sh dynbinary
 popd
 
 %check
-ver="$(engine/bundles/dynbinary-daemon/dockerd --version)"; \
+ver="$(engine/bundles/dynbinary/dockerd --version)"; \
     test "$ver" = "Docker version %{_origversion}, build %{_gitcommit_engine}" && echo "PASS: daemon version OK" || (echo "FAIL: daemon version ($ver) did not match" && exit 1)
 
 %install
-install -D -p -m 0755 $(readlink -f engine/bundles/dynbinary-daemon/dockerd) ${RPM_BUILD_ROOT}%{_bindir}/dockerd
-install -D -p -m 0755 $(readlink -f engine/bundles/dynbinary-daemon/docker-proxy) ${RPM_BUILD_ROOT}%{_bindir}/docker-proxy
+install -D -p -m 0755 $(readlink -f engine/bundles/dynbinary/dockerd) ${RPM_BUILD_ROOT}%{_bindir}/dockerd
+install -D -p -m 0755 $(readlink -f engine/bundles/dynbinary/docker-proxy) ${RPM_BUILD_ROOT}%{_bindir}/docker-proxy
 install -D -p -m 0755 /usr/local/bin/docker-init ${RPM_BUILD_ROOT}%{_bindir}/docker-init
 
 # install systemd scripts
diff --git a/rpm/centos-7/Dockerfile b/rpm/centos-7/Dockerfile
index 8ab5b0c882..e5cec7e24f 100644
--- a/rpm/centos-7/Dockerfile
+++ b/rpm/centos-7/Dockerfile
@@ -15,7 +15,6 @@ ENV GOPROXY=https://proxy.golang.org
 ENV GO111MODULE=off
 ENV GOPATH=/go
 ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
-ENV AUTO_GOPATH 1
 ARG DISTRO
 ARG SUITE
 ENV DISTRO=${DISTRO}
diff --git a/rpm/centos-8/Dockerfile b/rpm/centos-8/Dockerfile
index a85c697853..c1a1ad79b4 100644
--- a/rpm/centos-8/Dockerfile
+++ b/rpm/centos-8/Dockerfile
@@ -10,7 +10,6 @@ ENV GOPROXY=direct
 ENV GO111MODULE=off
 ENV GOPATH=/go
 ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
-ENV AUTO_GOPATH 1
 ENV DOCKER_BUILDTAGS exclude_graphdriver_btrfs
 ARG DISTRO
 ARG SUITE
diff --git a/rpm/centos-9/Dockerfile b/rpm/centos-9/Dockerfile
index d8ac71442e..3a9c121ff7 100644
--- a/rpm/centos-9/Dockerfile
+++ b/rpm/centos-9/Dockerfile
@@ -10,7 +10,6 @@ ENV GOPROXY=direct
 ENV GO111MODULE=off
 ENV GOPATH=/go
 ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
-ENV AUTO_GOPATH 1
 ENV DOCKER_BUILDTAGS exclude_graphdriver_btrfs
 ARG DISTRO
 ARG SUITE
diff --git a/rpm/fedora-34/Dockerfile b/rpm/fedora-34/Dockerfile
index 688cc0a370..58c9e80ad3 100644
--- a/rpm/fedora-34/Dockerfile
+++ b/rpm/fedora-34/Dockerfile
@@ -10,7 +10,6 @@ ENV GOPROXY=direct
 ENV GO111MODULE=off
 ENV GOPATH /go
 ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
-ENV AUTO_GOPATH 1
 ARG DISTRO
 ARG SUITE
 ENV DISTRO=${DISTRO}
diff --git a/rpm/fedora-35/Dockerfile b/rpm/fedora-35/Dockerfile
index d1b3f7f055..f04fccaafe 100644
--- a/rpm/fedora-35/Dockerfile
+++ b/rpm/fedora-35/Dockerfile
@@ -10,7 +10,6 @@ ENV GOPROXY=direct
 ENV GO111MODULE=off
 ENV GOPATH /go
 ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
-ENV AUTO_GOPATH 1
 ARG DISTRO
 ARG SUITE
 ENV DISTRO=${DISTRO}
diff --git a/rpm/fedora-36/Dockerfile b/rpm/fedora-36/Dockerfile
index 023c3a8ecb..d19098c0e4 100644
--- a/rpm/fedora-36/Dockerfile
+++ b/rpm/fedora-36/Dockerfile
@@ -10,7 +10,6 @@ ENV GOPROXY=direct
 ENV GO111MODULE=off
 ENV GOPATH /go
 ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
-ENV AUTO_GOPATH 1
 ARG DISTRO
 ARG SUITE
 ENV DISTRO=${DISTRO}
diff --git a/rpm/gen-rpm-ver b/rpm/gen-rpm-ver
index 4c9d438085..99fe19edbd 100755
--- a/rpm/gen-rpm-ver
+++ b/rpm/gen-rpm-ver
@@ -73,9 +73,9 @@ rpmRelease=1
 tilde='~'
 rpmVersion="${rpmVersion//-/$tilde}"
 
-DOCKER_GITCOMMIT=$($GIT_COMMAND rev-parse --short HEAD)
+GITCOMMIT=$($GIT_COMMAND rev-parse --short HEAD)
 if [ -n "$($GIT_COMMAND status --porcelain --untracked-files=no)" ]; then
-	DOCKER_GITCOMMIT="$DOCKER_GITCOMMIT-unsupported"
+	GITCOMMIT="$GITCOMMIT-unsupported"
 fi
 
 # if we have a "-dev" suffix or have change in Git, this is a nightly build, and
@@ -112,4 +112,4 @@ fi
 
 # Replace any remaining dashes with periods
 rpmVersion="${rpmVersion//-/.}"
-echo "$rpmVersion $rpmRelease $DOCKER_GITCOMMIT $origVersion"
+echo "$rpmVersion $rpmRelease $GITCOMMIT $origVersion"
diff --git a/rpm/rhel-7/Dockerfile b/rpm/rhel-7/Dockerfile
index bc487dbce1..e38633b5c5 100644
--- a/rpm/rhel-7/Dockerfile
+++ b/rpm/rhel-7/Dockerfile
@@ -10,7 +10,6 @@ ENV GOPROXY=direct
 ENV GO111MODULE=off
 ENV GOPATH=/go
 ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin
-ENV AUTO_GOPATH 1
 ARG DISTRO
 ARG SUITE
 ENV DISTRO=${DISTRO}
diff --git a/scripts/checkout.sh b/scripts/checkout.sh
index 6bc18479dd..c5a6ef7ae8 100755
--- a/scripts/checkout.sh
+++ b/scripts/checkout.sh
@@ -15,7 +15,7 @@
 #   limitations under the License.
 
 checkout() (
-	set -ex
+	set -e
 	SRC="$1"
 	REF="$2"
 	REF_FETCH="$REF"
@@ -27,11 +27,13 @@ checkout() (
 	else
 		REF="FETCH_HEAD"
 	fi
-	git -C "$SRC" fetch --update-head-ok --depth 1 origin "$REF_FETCH"
-	git -C "$SRC" checkout -q "$REF"
+	(
+		set -x
+		git -C "$SRC" fetch --update-head-ok --depth 1 origin "$REF_FETCH"
+		git -C "$SRC" checkout -q "$REF"
+	)
 )
 
-
 # Only execute checkout function above if this file is executed, not sourced from another script
 prog=checkout.sh # needs to be in sync with this file's name
 if [ "$(basename -- $0)" = "$prog" ]; then
diff --git a/static/Makefile b/static/Makefile
index 4850d61263..ee9e1be7a1 100644
--- a/static/Makefile
+++ b/static/Makefile
@@ -3,27 +3,30 @@ include ../common.mk
 CLI_DIR=$(realpath $(CURDIR)/../src/github.com/docker/cli)
 ENGINE_DIR=$(realpath $(CURDIR)/../src/github.com/docker/docker)
 BUILDX_DIR=$(realpath $(CURDIR)/../src/github.com/docker/buildx)
+COMPOSE_DIR=$(realpath $(CURDIR)/../src/github.com/docker/compose)
+SCAN_DIR=$(realpath $(CURDIR)/../src/github.com/docker/scan-cli-plugin)
+XX_DIR=$(realpath $(CURDIR)/../src/github.com/tonistiigi/xx)
 
-GEN_STATIC_VER=$(shell ./gen-static-ver $(CLI_DIR) $(VERSION))
+STATIC_VERSION=$(shell ./gen-static-ver $(CLI_DIR) $(VERSION))
 HASH_CMD=docker run -v $(CURDIR):/sum -w /sum debian:jessie bash hash_files
 DIR_TO_HASH:=build/linux
-DOCKER_CLI_GOLANG_IMG=golang:$(GO_VERSION)
 
-DOCKER_BUILD_OPTS=
+export CLI_DIR
+export ENGINE_DIR
+export BUILDX_DIR
+export COMPOSE_DIR
+export SCAN_DIR
+export XX_DIR
 
-ifneq ($(strip $(CONTAINERD_VERSION)),)
-# Set custom build-args to override the containerd version to build for static
-# packages. The Dockerfile for 20.10 and earlier used CONTAINERD_COMMIT, later
-# versions use CONTAINERD_VERSION. We can remove CONTAINERD_VERSION once 20.10.x
-# reaches EOL.
-DOCKER_BUILD_OPTS +=--build-arg=CONTAINERD_VERSION=$(CONTAINERD_VERSION)
-DOCKER_BUILD_OPTS +=--build-arg=CONTAINERD_COMMIT=$(CONTAINERD_VERSION)
-endif
+export STATIC_VERSION
 
-ifneq ($(strip $(RUNC_VERSION)),)
-# Set custom build-args to override the runc version to build for static packages.
-DOCKER_BUILD_OPTS +=--build-arg=RUNC_VERSION=$(RUNC_VERSION)
-endif
+# Select the default version of containerd based on the docker engine source
+# we need this variable here for naming the produced .tgz file.
+# TODO containerd binaries should be built as part of containerd-packaging, not as part of docker/docker-ce-packaging
+CONTAINERD_VERSION?=$(shell grep "ARG CONTAINERD_VERSION" "$(ENGINE_DIR)/Dockerfile.windows" | awk -F'=' '{print $$2}')
+
+export CONTAINERD_VERSION
+export RUNC_VERSION
 
 .PHONY: help
 help: ## show make targets
@@ -31,85 +34,16 @@ help: ## show make targets
 
 .PHONY: clean
 clean: ## remove build artifacts
-	[ ! -d build ] || $(CHOWN) -R $(shell id -u):$(shell id -g) build
-	$(RM) -r build
-	-docker builder prune -f --filter until=24h
-
-.PHONY: static
-static: static-linux cross-mac cross-win cross-arm ## create all static packages
-
-.PHONY: static-linux
-static-linux: static-cli static-engine static-buildx-plugin ## create tgz
-	mkdir -p build/linux/docker
-	cp $(CLI_DIR)/build/docker build/linux/docker/
-	for f in dockerd containerd ctr containerd-shim containerd-shim-runc-v2 docker-init docker-proxy runc; do \
-		cp -L $(ENGINE_DIR)/bundles/binary-daemon/$$f build/linux/docker/$$f; \
-	done
-	tar -C build/linux -c -z -f build/linux/docker-$(GEN_STATIC_VER).tgz docker
-
-	# extra binaries for running rootless
-	mkdir -p build/linux/docker-rootless-extras
-	for f in rootlesskit rootlesskit-docker-proxy dockerd-rootless.sh dockerd-rootless-setuptool.sh vpnkit; do \
-		if [ -f $(ENGINE_DIR)/bundles/binary-daemon/$$f ]; then \
-			cp -L $(ENGINE_DIR)/bundles/binary-daemon/$$f build/linux/docker-rootless-extras/$$f; \
-		fi \
-	done
-	tar -C build/linux -c -z -f build/linux/docker-rootless-extras-$(GEN_STATIC_VER).tgz docker-rootless-extras
+	$(call title,Removing build artifacts)
+	@[ ! -d build ] || $(CHOWN) -R $(shell id -u):$(shell id -g) build
+	@$(RM) -r build
 
-	# buildx
-	tar -C $(BUILDX_DIR)/bin -c -z -f build/linux/docker-buildx-plugin-$(DOCKER_BUILDX_REF:v%=%).tgz docker-buildx
+.PHONY: build
+build: ## build static package
+	$(call title,Building static package for $(TARGETPLATFORM))
+	./build-static "$(CURDIR)" "$(TARGETPLATFORM)"
 
 .PHONY: hash_files
-hash_files:
-	@echo "Hashing directory $(DIR_TO_HASH)"
+hash_files: ## hash files
+	$(call title,Hashing directory $(DIR_TO_HASH))
 	$(HASH_CMD) "$(DIR_TO_HASH)"
-
-.PHONY: buildx
-buildx:
-	docker buildx inspect | grep -q 'Driver: docker-container' || docker buildx create --use
-
-.PHONY: cross-mac
-cross-mac: buildx
-	cd $(CLI_DIR) && VERSION=$(GEN_STATIC_VER) docker buildx bake --set binary.platform=darwin/amd64,darwin/arm64 binary
-	dest=$$PWD/build/mac; cd $(CLI_DIR)/build && for platform in *; do \
-		arch=$$(echo $$platform | cut -d_ -f2); \
-		mkdir -p $$dest/$$arch/docker; \
-		cp $$platform/docker-darwin-* $$dest/$$arch/docker/docker && \
-		tar -C $$dest/$$arch -c -z -f $$dest/$$arch/docker-$(GEN_STATIC_VER).tgz docker; \
-	done
-
-.PHONY: cross-win
-cross-win: cross-win-engine
-	cd $(CLI_DIR) && VERSION=$(GEN_STATIC_VER) docker buildx bake --set binary.platform=windows/amd64 binary
-	mkdir -p build/win/amd64/docker
-	cp $(CLI_DIR)/build/docker-windows-amd64.exe build/win/amd64/docker/docker.exe
-	cp $(ENGINE_DIR)/bundles/cross/windows/amd64-daemon/dockerd.exe build/win/amd64/docker/dockerd.exe
-	cp $(ENGINE_DIR)/bundles/cross/windows/amd64-daemon/docker-proxy.exe build/win/amd64/docker/docker-proxy.exe
-	docker run --rm -v $(CURDIR)/build/win/amd64:/v -w /v alpine sh -c 'apk update&&apk add zip&&zip -r docker-$(GEN_STATIC_VER).zip docker'
-	$(CHOWN) -R $(shell id -u):$(shell id -g) build
-
-.PHONY: cross-arm
-cross-arm: cross-all-cli ## create tgz with linux armhf client only
-	mkdir -p build/arm/docker
-	cp $(CLI_DIR)/build/docker-linux-arm build/arm/docker/docker
-	tar -C build/arm -c -z -f build/arm/docker-$(GEN_STATIC_VER).tgz docker
-
-.PHONY: static-cli
-static-cli:
-	cd $(CLI_DIR) && VERSION=$(GEN_STATIC_VER) docker buildx bake --set binary.platform=$(TARGETPLATFORM) --set binary.args.CGO_ENABLED=$(CGO_ENABLED) binary
-
-.PHONY: static-engine
-static-engine:
-	$(MAKE) -C $(ENGINE_DIR) VERSION=$(GEN_STATIC_VER) DOCKER_BUILD_OPTS="$(DOCKER_BUILD_OPTS)" binary
-
-.PHONY: static-buildx-plugin
-static-buildx-plugin:
-	cd $(BUILDX_DIR) && docker buildx bake --set binaries.platform=$(TARGETPLATFORM) binaries && mv ./bin/buildx ./bin/docker-buildx
-
-.PHONY: cross-all-cli
-cross-all-cli:
-	$(MAKE) -C $(CLI_DIR) -f docker.Makefile VERSION=$(GEN_STATIC_VER) cross
-
-.PHONY: cross-win-engine
-cross-win-engine:
-	$(MAKE) -C $(ENGINE_DIR) VERSION=$(GEN_STATIC_VER) DOCKER_CROSSPLATFORMS=windows/amd64 DOCKER_BUILD_OPTS="$(DOCKER_BUILD_OPTS)" cross
diff --git a/static/README.md b/static/README.md
new file mode 100644
index 0000000000..1f25007cd9
--- /dev/null
+++ b/static/README.md
@@ -0,0 +1,55 @@
+# Building your own Docker static package
+
+Static packages can be built from root directory with the following syntax
+
+```console
+make TARGETPLATFORM=${TARGETOS}/${TARGETARCH}/${TARGETVARIANT} static
+```
+
+Format of `TARGETOS`, `TARGETARCH`, `TARGETVARIANT` is the same as the [platform ARGs in the global scope](https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope)
+for a Dockerfile like `linux/arm/v7`.
+
+Artifacts will be located in `build` under the following directory structure:
+`build/$os/$arch/$variant/` or `build/$os/$arch/` if there is no variant being
+used.
+
+### Building from local source
+
+Specify the location of the source repositories for the engine and cli when
+building packages
+
+* `ENGINE_DIR` -> Specifies the directory where the engine code is located, eg: `$GOPATH/src/github.com/docker/docker`
+* `CLI_DIR` -> Specifies the directory where the cli code is located, eg: `$GOPATH/src/github.com/docker/cli`
+
+```shell
+make ENGINE_DIR=/path/to/engine CLI_DIR=/path/to/cli TARGETPLATFORM=linux/amd64 static
+```
+
+## Supported platforms
+
+Here is a list of platforms that are currently supported:
+
+```console
+make TARGETPLATFORM=linux/amd64 static
+make TARGETPLATFORM=linux/arm/v6 static
+make TARGETPLATFORM=linux/arm/v7 static
+make TARGETPLATFORM=linux/arm64 static
+make TARGETPLATFORM=darwin/amd64 static
+make TARGETPLATFORM=darwin/arm64 static
+make TARGETPLATFORM=windows/amd64 static
+```
+
+> note: `darwin` only packages the docker cli and plugins.
+
+But you can test building against whatever platform you want like:
+
+```console
+make TARGETPLATFORM=linux/riscv64 static
+make TARGETPLATFORM=linux/s390x static
+```
+
+Or the current one matching your host if not defined:
+
+```console
+make static
+```
diff --git a/static/build-static b/static/build-static
new file mode 100755
index 0000000000..7e547c6a3b
--- /dev/null
+++ b/static/build-static
@@ -0,0 +1,362 @@
+#!/usr/bin/env bash
+set -e
+
+function xx-info() {
+	"$XX_DIR"/base/xx-info "$1"
+}
+
+CURDIR="$1"
+if [ -z "$CURDIR" ]; then
+	# shellcheck disable=SC2016
+	echo 'CURDIR is required. See README.md for usage.'
+	exit 1
+fi
+
+TARGETPLATFORM="$2"
+if [ -z "$TARGETPLATFORM" ]; then
+	TARGETPLATFORM="$(xx-info os)/$(xx-info arch)"
+	if [ -n "$(xx-info variant)" ]; then
+		TARGETPLATFORM="$TARGETPLATFORM/$(xx-info variant)"
+	fi
+fi
+# TARGETPLATFORM is also used by xx-info
+export TARGETPLATFORM
+
+build_cli() {
+	(
+		cd "${CLI_DIR}"
+		set -x
+		docker buildx build \
+			--build-arg BUILDKIT_MULTI_PLATFORM=true \
+			--build-arg GO_LINKMODE=static \
+			--build-arg DEFAULT_PRODUCT_LICENSE \
+			--build-arg PACKAGER_NAME \
+			--build-arg PLATFORM \
+			--build-arg PRODUCT \
+			--build-arg VERSION="${STATIC_VERSION}" \
+			--output ./build \
+			--platform "${TARGETPLATFORM}" \
+			--target binary .
+	)
+}
+
+build_engine() {
+	(
+		cd "${ENGINE_DIR}"
+		set -x
+		docker buildx build \
+			--build-arg BUILDKIT_MULTI_PLATFORM=true \
+			--build-arg DOCKER_LINKMODE=static \
+			--build-arg CONTAINERD_VERSION \
+			--build-arg DEFAULT_PRODUCT_LICENSE \
+			--build-arg PACKAGER_NAME \
+			--build-arg PLATFORM \
+			--build-arg PRODUCT \
+			--build-arg VERSION="${STATIC_VERSION}" \
+			--output ./build \
+			--platform "${TARGETPLATFORM}" \
+			--target all .
+	)
+}
+
+build_buildx() {
+	(
+		cd "${BUILDX_DIR}"
+		set -x
+		docker buildx build \
+			--platform "${TARGETPLATFORM}" \
+			--build-arg BUILDKIT_MULTI_PLATFORM=true \
+			--output "./bin" \
+			--target binaries .
+	)
+}
+
+build_compose() {
+	(
+		cd "${COMPOSE_DIR}"
+		set -x
+		# TODO: Add TARGETPLATFORM support on compose repo to build efficiently with buildx
+		make GIT_TAG="${DOCKER_COMPOSE_REF}" cross
+	)
+}
+
+build_scan() {
+	(
+		cd "${SCAN_DIR}"
+		set -x
+		# TODO: Add TARGETPLATFORM support on scan-cli-plugin repo to build efficiently with --platform
+		make GIT_TAG_NAME="${DOCKER_SCAN_REF}" cross
+	)
+}
+
+xx-info env
+echo "TARGETPLATFORM=${TARGETPLATFORM}"
+echo "CONTAINERD_VERSION=${CONTAINERD_VERSION}"
+
+targetPair="$(xx-info os)_$(xx-info arch)"
+if [ -n "$(xx-info variant)" ]; then
+	targetPair="${targetPair}_$(xx-info variant)"
+fi
+
+buildDir="${CURDIR}/build/${TARGETPLATFORM}"
+
+dockerCLIBuildDir="${buildDir}/docker-cli"
+dockerBuildDir="${buildDir}/docker-engine"
+containerdBuildDir="${buildDir}/containerd"
+rootlessExtrasBuildDir="${buildDir}/docker-rootless-extras"
+buildxBuildDir="${buildDir}/docker-buildx"
+composeBuildDir="${buildDir}/docker-compose"
+scanBuildDir="${buildDir}/docker-scan"
+
+# clean up previous build output dirs
+[ -d "${CLI_DIR:?}/build" ] && rm -r "${CLI_DIR:?}/build"
+[ -d "${ENGINE_DIR:?}/build" ] && rm -r "${ENGINE_DIR:?}/build"
+[ -d "${BUILDX_DIR:?}/bin" ] && rm -r "${BUILDX_DIR:?}/bin"
+[ -d "${COMPOSE_DIR:?}/bin" ] && rm -r "${COMPOSE_DIR:?}/bin"
+[ -d "${SCAN_DIR:?}/dist" ] && rm -r "${SCAN_DIR:?}/dist"
+
+# create docker-container builder
+docker buildx inspect | grep -q 'Driver: docker-container' || docker buildx create --use
+
+case $(xx-info os) in
+	linux)
+		build_cli
+		build_engine
+		build_buildx
+		build_compose
+		# TODO change once we support scan-plugin on other architectures
+		if [ "$(xx-info arch)" = "amd64" ]; then
+			build_scan
+		fi
+		;;
+	darwin)
+		build_cli
+		build_buildx
+		build_compose
+		build_scan
+		;;
+	windows)
+		build_cli
+		build_engine
+		build_buildx
+		build_compose
+		# TODO change once we support scan-plugin on other architectures
+		if [ "$(xx-info arch)" = "amd64" ]; then
+			build_scan
+		fi
+		;;
+esac
+
+# cleanup
+[ -d "${buildDir}" ] && rm -r "${buildDir}"
+
+# docker CLI
+mkdir -p "${dockerCLIBuildDir}"
+case $(xx-info os) in
+	linux | darwin)
+		cp "${CLI_DIR}"/build/"${targetPair}"/docker-"$(xx-info os)"-* "${dockerCLIBuildDir}/docker"
+		;;
+	windows)
+		cp "${CLI_DIR}"/build/"${targetPair}"/docker-"$(xx-info os)"-*.exe "${dockerCLIBuildDir}/docker.exe"
+		;;
+esac
+# package docker CLI
+case $(xx-info os) in
+	linux | darwin)
+		(
+			set -x
+			tar -C "${buildDir}" -c -z -f "${buildDir}/docker-cli-${STATIC_VERSION}.tgz" docker-cli
+		)
+		;;
+	windows)
+		(
+			cd "${buildDir}"
+			set -x
+			zip -r "docker-cli-${STATIC_VERSION}.zip" docker-cli
+		)
+		;;
+esac
+
+# docker, containerd, and runc
+mkdir -p "${dockerBuildDir}"
+case $(xx-info os) in
+	linux)
+		for f in dockerd docker-init docker-proxy; do
+			if [ -f "${ENGINE_DIR}/build/${targetPair}/$f" ]; then
+				cp -L "${ENGINE_DIR}/build/${targetPair}/$f" "${dockerBuildDir}/$f"
+			fi
+		done
+		# TODO containerd binaries should be built as part of containerd-packaging, not as part of docker/docker-ce-packaging
+		mkdir -p "${containerdBuildDir}"
+		for f in containerd ctr containerd-shim containerd-shim-runc-v2 runc; do
+			if [ -f "${ENGINE_DIR}/build/${targetPair}/$f" ]; then
+				cp -L "${ENGINE_DIR}/build/${targetPair}/$f" "${containerdBuildDir}/$f"
+			fi
+		done
+		;;
+	windows)
+		for f in dockerd.exe docker-proxy.exe; do
+			if [ -f "${ENGINE_DIR}/build/${targetPair}/$f" ]; then
+				cp -L "${ENGINE_DIR}/build/${targetPair}/$f" "${dockerBuildDir}/$f"
+			fi
+		done
+		;;
+esac
+# package docker, containerd, and runc
+case $(xx-info os) in
+	darwin)
+		(
+			set -x
+			tar -C "${buildDir}" -c -z -f "${buildDir}/docker-engine-${STATIC_VERSION}.tgz" docker-engine
+		)
+		;;
+	linux)
+		(
+			set -x
+			tar -C "${buildDir}" -c -z -f "${buildDir}/docker-engine-${STATIC_VERSION}.tgz" docker-engine
+			tar -C "${buildDir}" -c -z -f "${buildDir}/containerd-${CONTAINERD_VERSION#v}.tgz" containerd
+		)
+		;;
+	windows)
+		(
+			cd "${buildDir}"
+			set -x
+			zip -r "docker-engine-${STATIC_VERSION}.zip" docker-engine
+		)
+		;;
+esac
+
+# rootless extras
+case $(xx-info os) in
+	linux)
+		for f in rootlesskit rootlesskit-docker-proxy dockerd-rootless.sh dockerd-rootless-setuptool.sh vpnkit; do
+			if [ -f "${ENGINE_DIR}/bundles/${TARGETPLATFORM}/$f" ]; then
+				mkdir -p "${rootlessExtrasBuildDir}"
+				cp -L "${ENGINE_DIR}/bundles/${TARGETPLATFORM}/$f" "${rootlessExtrasBuildDir}/$f"
+			fi
+		done
+		;;
+esac
+# package rootless extras
+if [ -d "${rootlessExtrasBuildDir}" ]; then
+	case $(xx-info os) in
+		linux)
+			(
+				set -x
+				tar -C "${buildDir}" -c -z -f "${buildDir}/docker-rootless-extras-${STATIC_VERSION}.tgz" docker-rootless-extras
+			)
+			;;
+	esac
+fi
+
+# buildx
+if [ -d "${BUILDX_DIR}/bin" ]; then
+	mkdir -p "${buildxBuildDir}"
+	case $(xx-info os) in
+		linux | darwin)
+			cp "${BUILDX_DIR}/bin/${targetPair}/buildx" "${buildxBuildDir}/docker-buildx"
+			;;
+		windows)
+			cp "${BUILDX_DIR}/bin/${targetPair}/buildx.exe" "${buildxBuildDir}/docker-buildx.exe"
+			;;
+	esac
+	# package buildx
+	case $(xx-info os) in
+		linux | darwin)
+			(
+				set -x
+				tar -C "${buildDir}" -c -z -f "${buildDir}/docker-buildx-plugin-${DOCKER_BUILDX_REF#v}.tgz" docker-buildx
+			)
+			;;
+		windows)
+			(
+				cd "${buildDir}"
+				set -x
+				zip -r "docker-buildx-plugin-${DOCKER_BUILDX_REF#v}.zip" docker-buildx
+			)
+			;;
+	esac
+fi
+
+# compose
+if [ -d "${COMPOSE_DIR}/bin" ]; then
+	mkdir -p "${composeBuildDir}"
+	composeTargetPair="$(xx-info os)"
+	case $(xx-info arch) in
+		amd64)
+			composeTargetPair="${composeTargetPair}-x86_64"
+			;;
+		arm64)
+			composeTargetPair="${composeTargetPair}-aarch64"
+			;;
+		*)
+			composeTargetPair="${composeTargetPair}-$(xx-info arch)"
+			;;
+	esac
+	if [ -n "$(xx-info variant)" ]; then
+		composeTargetPair="${composeTargetPair}$(xx-info variant)"
+	fi
+	case $(xx-info os) in
+		linux | darwin)
+			cp "${COMPOSE_DIR}/bin/docker-compose-${composeTargetPair}" "${composeBuildDir}/docker-compose"
+			;;
+		windows)
+			cp "${COMPOSE_DIR}/bin/docker-compose-${composeTargetPair}.exe" "${composeBuildDir}/docker-compose.exe"
+			;;
+	esac
+	# package compose
+	case $(xx-info os) in
+		linux | darwin)
+			(
+				set -x
+				tar -C "${buildDir}" -c -z -f "${buildDir}/docker-compose-plugin-${DOCKER_COMPOSE_REF#v}.tgz" docker-compose
+			)
+			;;
+		windows)
+			(
+				cd "${buildDir}"
+				set -x
+				zip -r "docker-compose-plugin-${DOCKER_COMPOSE_REF#v}.zip" docker-compose
+			)
+			;;
+	esac
+fi
+
+# scan
+if [ -d "${SCAN_DIR}/dist" ]; then
+	mkdir -p "${scanBuildDir}"
+	case $(xx-info os) in
+		linux | darwin)
+			cp "${SCAN_DIR}/dist/docker-scan_$(xx-info os)_$(xx-info arch)" "${scanBuildDir}/docker-scan"
+			;;
+		windows)
+			cp "${SCAN_DIR}/dist/docker-scan_$(xx-info os)_$(xx-info arch).exe" "${scanBuildDir}/docker-scan.exe"
+			;;
+	esac
+	# package compose
+	case $(xx-info os) in
+		linux | darwin)
+			(
+				set -x
+				tar -C "${buildDir}" -c -z -f "${buildDir}/docker-scan-plugin-${DOCKER_SCAN_REF#v}.tgz" docker-scan
+			)
+			;;
+		windows)
+			(
+				cd "${buildDir}"
+				set -x
+				zip -r "docker-scan-plugin-${DOCKER_SCAN_REF#v}.zip" docker-scan
+			)
+			;;
+	esac
+fi
+
+# create bundle
+(
+	# bundle is expected to have a tar.gz extension, unlike the other archives, which use .tgz
+	bundlesFilename="bundles-ce-static-$(xx-info os)-$(xx-info arch)$(xx-info variant).tar.gz"
+	set -x
+	cd "${buildDir}"
+	rm -r */
+	tar -zvcf "${CURDIR}/build/${bundlesFilename}" .
+)
diff --git a/static/hash_files b/static/hash_files
index 6218d977a5..e2feda7911 100644
--- a/static/hash_files
+++ b/static/hash_files
@@ -6,6 +6,6 @@ DIR_TO_LOOK_IN=${1:-build/linux}
 
 for f in $(find "$DIR_TO_LOOK_IN" -type f); do
 	for hash_algo in md5 sha256; do
-		"${hash_algo}sum" "$f" >"$f.$hash_algo"
+		"${hash_algo}sum" "$f" > "$f.$hash_algo"
 	done
 done