diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
new file mode 100644
index 0000000..77328e3
--- /dev/null
+++ b/.github/workflows/build.yaml
@@ -0,0 +1,70 @@
+name: build
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && github.run_id || github.head_ref || github.ref }}-${{ github.workflow }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build kernel #and system
+    runs-on: namespace-profile-arm64-8x16-2004-caching
+    timeout-minutes: 20
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        lfs: true
+
+    - name: get kernel submodule ref
+      id: kernel-submodule
+      run: echo "ref=$(git ls-tree HEAD | awk '$4 == "agnos-kernel-sdm845"' | awk '{print $3}')" >> "$GITHUB_OUTPUT"
+
+    - name: Checkout agnos-kernel-sdm845
+      uses: actions/checkout@v4
+      with:
+        repository: commaai/agnos-kernel-sdm845
+        ref: ${{ steps.kernel-submodule.outputs.ref }}
+        path: agnos-kernel-sdm845
+
+    - name: Install dependencies
+      run: sudo apt-get update && sudo apt-get install -y bc img2simg
+
+    - name: Install python2
+      uses: gabrielfalcao/pyenv-action@2f49ca7587f9d0663d13f1147b78d3361417eaf7
+      with:
+        default: '2.7.18'
+
+    - name: Cache kernel build
+      uses: actions/cache@v4
+      id: cache-kernel
+      with:
+        key: kernel-${{ steps.kernel-submodule.outputs.ref }}
+        path: |
+          agnos-kernel-sdm845/out
+        restore-keys: kernel-
+
+    - name: Build kernel
+      run: ./build_kernel.sh
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: boot.img
+        path: output/boot.img
+    - uses: actions/upload-artifact@v4
+      with:
+        name: kernel-modules
+        path: output/*.ko
+
+    #- run: ./build_system.sh
+    #- uses: actions/upload-artifact@v4
+    #  with:
+    #    name: system.img
+    #    path: output/system.img
diff --git a/build_kernel.sh b/build_kernel.sh
index bb70289..6df7b85 100755
--- a/build_kernel.sh
+++ b/build_kernel.sh
@@ -16,13 +16,16 @@ if git submodule status --cached agnos-kernel-sdm845/ | grep "^-"; then
 fi
 cd agnos-kernel-sdm845
 
-$DIR/tools/extract_tools.sh
-
 # Build parameters
+ARCH=$(uname -m)
+if [ "$ARCH" != "arm64" ] && [ "$ARCH" != "aarch64" ]; then
+  export CROSS_COMPILE=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-
+  export CC=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-gcc
+  export LD=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-ld.bfd
+
+  $DIR/tools/extract_tools.sh
+fi
 export ARCH=arm64
-export CROSS_COMPILE=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-
-export CC=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-gcc
-export LD=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-ld.bfd
 
 # these do anything?
 export KCFLAGS="-w"
diff --git a/build_system.sh b/build_system.sh
index 0244870..0badd50 100755
--- a/build_system.sh
+++ b/build_system.sh
@@ -48,45 +48,50 @@ echo "Building image"
 export DOCKER_CLI_EXPERIMENTAL=enabled
 docker build -f Dockerfile.agnos -t agnos-builder $DIR
 
+# Setup mount container
+MOUNT_CONTAINER_ID=$(docker run -d --privileged --volume $BUILD_DIR:$BUILD_DIR ubuntu:latest sleep infinity)
+
 # Create filesystem ext4 image
 echo "Creating empty filesystem"
-fallocate -l $ROOTFS_IMAGE_SIZE $ROOTFS_IMAGE
-mkfs.ext4 $ROOTFS_IMAGE > /dev/null
+docker exec $MOUNT_CONTAINER_ID fallocate -l $ROOTFS_IMAGE_SIZE $ROOTFS_IMAGE
+docker exec $MOUNT_CONTAINER_ID mkfs.ext4 $ROOTFS_IMAGE > /dev/null
 
 # Mount filesystem
 echo "Mounting empty filesystem"
-mkdir -p $ROOTFS_DIR
-sudo umount -l $ROOTFS_DIR > /dev/null || true
-sudo mount $ROOTFS_IMAGE $ROOTFS_DIR
+docker exec $MOUNT_CONTAINER_ID mkdir -p $ROOTFS_DIR
+docker exec $MOUNT_CONTAINER_ID mount -o loop $ROOTFS_IMAGE $ROOTFS_DIR
 
 # Extract image
 echo "Extracting docker image"
 CONTAINER_ID=$(docker container create --entrypoint /bin/bash agnos-builder:latest)
 docker container export -o $BUILD_DIR/filesystem.tar $CONTAINER_ID
 docker container rm $CONTAINER_ID > /dev/null
+docker exec $MOUNT_CONTAINER_ID tar -xf $BUILD_DIR/filesystem.tar -C $ROOTFS_DIR > /dev/null
+
 cd $ROOTFS_DIR
-sudo tar -xf $BUILD_DIR/filesystem.tar > /dev/null
 
 # Add hostname and hosts. This cannot be done in the docker container...
 echo "Setting network stuff"
 HOST=comma
-sudo bash -c "ln -sf /proc/sys/kernel/hostname etc/hostname"
-sudo bash -c "echo \"127.0.0.1    localhost.localdomain localhost\" > etc/hosts"
-sudo bash -c "echo \"127.0.0.1    $HOST\" >> etc/hosts"
+docker exec -w $ROOTFS_DIR $MOUNT_CONTAINER_ID bash -c "\
+ln -sf /proc/sys/kernel/hostname etc/hostname; \
+echo \"127.0.0.1    localhost.localdomain localhost\" > etc/hosts \
+echo \"127.0.0.1    $HOST\" >> etc/hosts"
 
 # Fix resolv config
-sudo bash -c "ln -sf /run/systemd/resolve/stub-resolv.conf etc/resolv.conf"
+docker exec -w $ROOTFS_DIR $MOUNT_CONTAINER_ID bash -c "ln -sf /run/systemd/resolve/stub-resolv.conf etc/resolv.conf"
 
 # Write build info
 DATETIME=$(date '+%Y-%m-%dT%H:%M:%S')
 GIT_HASH=$(git --git-dir=$DIR/.git rev-parse HEAD)
-sudo bash -c "printf \"$GIT_HASH\n$DATETIME\" > BUILD"
-
-cd $DIR
+docker exec -w $ROOTFS_DIR $MOUNT_CONTAINER_ID bash -c "printf \"$GIT_HASH\n$DATETIME\" > BUILD"
 
 # Unmount image
 echo "Unmount filesystem"
-sudo umount -l $ROOTFS_DIR
+docker exec $MOUNT_CONTAINER_ID umount -l $ROOTFS_DIR
+docker rm -f $MOUNT_CONTAINER_ID > /dev/null
+
+cd $DIR
 
 # Sparsify
 echo "Sparsify image"