diff --git a/.docker/copybara b/.docker/copybara
new file mode 100755
index 000000000..2d613353b
--- /dev/null
+++ b/.docker/copybara
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+# Handle environment variables for backwards compatibility
+if [ -n "${COPYBARA_SUBCOMMAND}" ] || [ -n "${COPYBARA_CONFIG}" ] || [ -n "${COPYBARA_WORKFLOW}" ] || [ -n "${COPYBARA_SOURCEREF}" ] || [ -n "${COPYBARA_OPTIONS}" ]; then
+  echo "Detected \$COPYBARA_* environment variables, overwriting shell args"
+  ARGS=()
+  if [ -n "${COPYBARA_SUBCOMMAND}" ]; then
+    ARGS+=("${COPYBARA_SUBCOMMAND}")
+  else
+    ARGS+=("migrate")
+  fi
+  if [ -n "${COPYBARA_CONFIG}" ]; then
+    ARGS+=("${COPYBARA_CONFIG}")
+  else
+    ARGS+=("copy.bara.sky")
+  fi
+  if [ -n "${COPYBARA_WORKFLOW}" ]; then
+    ARGS+=("${COPYBARA_WORKFLOW}")
+  else
+    ARGS+=("default")
+  fi
+  if [ -n "${COPYBARA_SOURCEREF}" ]; then
+    ARGS+=("${COPYBARA_SOURCEREF}")
+  fi
+  if [ -n "${COPYBARA_OPTIONS}" ]; then
+    ARGS+=(${COPYBARA_OPTIONS})  # no quotation marks to split them by space
+  fi
+  echo "Setting arguments to: \"${ARGS[@]}\""
+  set -- "${ARGS[@]}"
+fi
+
+exec java -jar /opt/copybara/copybara_deploy.jar "$@"
diff --git a/.docker/entrypoint.sh b/.docker/entrypoint.sh
deleted file mode 100644
index ffd2e976e..000000000
--- a/.docker/entrypoint.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-#
-# Copyright 2018 Google Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-java -jar /opt/copybara/copybara_deploy.jar $COPYBARA_OPTIONS $COPYBARA_SUBCOMMAND $COPYBARA_CONFIG $COPYBARA_WORKFLOW $COPYBARA_SOURCEREF
diff --git a/Dockerfile b/Dockerfile
index a92a1ea46..7ba7ddaab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,30 +12,23 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM gcr.io/bazel-public/bazel:6.0.0 AS build
-
-USER root
+ARG BAZEL_VERSION=6.0.0
+FROM gcr.io/bazel-public/bazel:${BAZEL_VERSION} AS build
 COPY . .
-RUN ./cloudbuild.sh build //java/com/google/copybara:copybara_deploy.jar
-RUN mkdir -p /tmp/copybara && \
-    cp bazel-bin/java/com/google/copybara/copybara_deploy.jar /tmp/copybara/
+RUN bazel build //java/com/google/copybara:copybara_deploy.jar
 
-USER ubuntu
 FROM golang:latest AS buildtools
 RUN go install github.com/bazelbuild/buildtools/buildozer@latest
 RUN go install github.com/bazelbuild/buildtools/buildifier@latest
 
 FROM openjdk:11-jre-slim
-WORKDIR /usr/src/app
-ENV COPYBARA_CONFIG=copy.bara.sky \
-    COPYBARA_SUBCOMMAND=migrate \
-    COPYBARA_OPTIONS='' \
-    COPYBARA_WORKFLOW=default \
-    COPYBARA_SOURCEREF=''
-COPY --from=build /tmp/copybara/ /opt/copybara/
+# Install git and cleanup apt cache afterwards to keep image size small
+RUN apt-get update && apt-get install -y \
+        git \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=build /home/ubuntu/bazel-bin/java/com/google/copybara/copybara_deploy.jar /opt/copybara/
 COPY --from=buildtools /go/bin/buildozer /go/bin/buildifier /usr/bin/
-COPY .docker/entrypoint.sh /usr/local/bin/copybara
-RUN chmod +x /usr/local/bin/copybara
-RUN apt-get update && \
-    apt-get install -y git && \
-    apt-get clean
+COPY .docker/copybara /usr/local/bin/copybara
+ENTRYPOINT ["/usr/local/bin/copybara"]
+CMD ["migrate", "copy.bara.sky"]
+WORKDIR /usr/src/app
diff --git a/README.md b/README.md
index fa2625084..2ed6dc224 100644
--- a/README.md
+++ b/README.md
@@ -167,40 +167,44 @@ Once this has finished building, you can run the image like so from the root of
 the code you are trying to use Copybara on:
 
 ```sh
-docker run -it -v "$(pwd)":/usr/src/app copybara copybara
+docker run -it -v "$(pwd)":/usr/src/app copybara help
 ```
 
-A few environment variables exist to allow you to change how you run copybara:
-* `COPYBARA_CONFIG=copy.bara.sky`
-  * allows you to specify a path to a config file, defaults to root `copy.bara.sky`
+#### Environment variables
+
+In addition to passing cmd args to the container, you can also set the following
+environment variables as an alternative:
 * `COPYBARA_SUBCOMMAND=migrate`
   * allows you to change the command run, defaults to `migrate`
-* `COPYBARA_OPTIONS=''`
-  * allows you to specify options for copybara, defaults to none
+* `COPYBARA_CONFIG=copy.bara.sky`
+  * allows you to specify a path to a config file, defaults to root `copy.bara.sky`
 * `COPYBARA_WORKFLOW=default`
   * allows you to specify the workflow to run, defaults to `default`
 * `COPYBARA_SOURCEREF=''`
   * allows you to specify the sourceref, defaults to none
+* `COPYBARA_OPTIONS=''`
+  * allows you to specify options for copybara, defaults to none
 
 ```sh
 docker run \
-    -e COPYBARA_CONFIG='other.config.sky' \
     -e COPYBARA_SUBCOMMAND='validate' \
+    -e COPYBARA_CONFIG='other.config.sky' \
     -v "$(pwd)":/usr/src/app \
-    -it copybara copybara
+    -it copybara
 ```
 
 #### Git Config and Credentials
 
 There are a number of ways by which to share your git config and ssh credentials
-with the Docker container, an example with macOS is below:
+with the Docker container, an example is below:
 
 ```sh
 docker run \
+    -v ~/.gitconfig:/root/.gitconfig:ro \
     -v ~/.ssh:/root/.ssh \
-    -v ~/.gitconfig:/root/.gitconfig \
+    -v ${SSH_AUTH_SOCK}:${SSH_AUTH_SOCK} -e SSH_AUTH_SOCK
     -v "$(pwd)":/usr/src/app \
-    -it copybara copybara
+    -it copybara
 ```
 
 ## Documentation