diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0002a0e0..ece6c711 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,7 +58,7 @@ jobs:
       - name: Push image to docker hub
         run: |
           echo ${{ secrets.DOCKER_PASSWORD }} | docker login -u ${{ secrets.DOCKER_USER }} --password-stdin
-          make all-image
+          make container
 
       - name: Repository Dispatch
         uses: peter-evans/repository-dispatch@v1
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 88725102..8984e3e5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
         run: |
           echo ${{ secrets.DOCKER_PASSWORD }} | docker login -u ${{ secrets.DOCKER_USER }} --password-stdin
           export VERSION=test
-          make all-image
+          make container
   linux:
     runs-on: ubuntu-latest
     needs: [ "image" ]
diff --git a/Makefile b/Makefile
index 1209bb65..4cd3634c 100644
--- a/Makefile
+++ b/Makefile
@@ -12,11 +12,16 @@ BASE := github.com/wencaiwulue/kubevpn
 FOLDER := ${BASE}/cmd/kubevpn
 BUILD_DIR := ./build
 OUTPUT_DIR := ./bin
-REGISTRY ?= naison
+REGISTRY ?= docker.io
+NAMESPACE ?= naison
+REPOSITORY ?= kubevpn
+IMAGE ?= $(REGISTRY)/$(NAMESPACE)/$(REPOSITORY):$(VERSION)
+IMAGE_DEFAULT = docker.io/naison/kubevpn:latest
 
 # Setup the -ldflags option for go build here, interpolate the variable values
 LDFLAGS=--ldflags "\
- -X ${BASE}/config.Version=${VERSION} \
+ -X ${BASE}/pkg/config.Image=${IMAGE} \
+ -X ${FOLDER}/cmds.Version=${VERSION} \
  -X ${FOLDER}/cmds.BuildTime=${BUILD_TIME} \
  -X ${FOLDER}/cmds.GitCommit=${GIT_COMMIT} \
  -X ${FOLDER}/cmds.Branch=${BRANCH} \
@@ -27,19 +32,13 @@ GO111MODULE=on
 GOPROXY=https://goproxy.cn,direct
 
 .PHONY: all
-all: all-kubevpn all-image
+all: all-kubevpn container
 
 .PHONY: all-kubevpn
 all-kubevpn: kubevpn-darwin-amd64 kubevpn-darwin-arm64 \
 kubevpn-windows-amd64 kubevpn-windows-386 kubevpn-windows-arm64 \
 kubevpn-linux-amd64 kubevpn-linux-386 kubevpn-linux-arm64
 
-.PHONY: all-image
-all-image: image image-mesh image-control-plane
-
-.PHONY: all-image-local
-all-image-local: image-local image-mesh-local image-control-plane-local
-
 .PHONY: kubevpn
 kubevpn:
 	make $(TARGET)
@@ -82,43 +81,19 @@ kubevpn-linux-386:
 	chmod +x $(OUTPUT_DIR)/kubevpn-linux-386
 # ---------linux-----------
 
-.PHONY: image
-image:
-	docker build -t $(REGISTRY)/kubevpn:${VERSION} -f $(BUILD_DIR)/server/Dockerfile .
-	docker tag $(REGISTRY)/kubevpn:${VERSION} $(REGISTRY)/kubevpn:latest
-	docker push $(REGISTRY)/kubevpn:${VERSION}
-	docker push $(REGISTRY)/kubevpn:latest
-
-.PHONY: image-mesh
-image-mesh:
-	docker build -t $(REGISTRY)/kubevpn-mesh:${VERSION} -f $(BUILD_DIR)/mesh/Dockerfile .
-	docker tag $(REGISTRY)/kubevpn-mesh:${VERSION} $(REGISTRY)/kubevpn-mesh:latest
-	docker push $(REGISTRY)/kubevpn-mesh:${VERSION}
-	docker push $(REGISTRY)/kubevpn-mesh:latest
-
-
-.PHONY: image-control-plane
-image-control-plane:
-	docker build -t $(REGISTRY)/envoy-xds-server:${VERSION} -f $(BUILD_DIR)/control_plane/Dockerfile .
-	docker tag $(REGISTRY)/envoy-xds-server:${VERSION} $(REGISTRY)/envoy-xds-server:latest
-	docker push $(REGISTRY)/envoy-xds-server:${VERSION}
-	docker push $(REGISTRY)/envoy-xds-server:latest
+.PHONY: container
+container:
+	docker build -t ${IMAGE} -f $(BUILD_DIR)/Dockerfile .
+	docker push ${IMAGE}
+	docker tag ${IMAGE} ${IMAGE_DEFAULT}
+	docker push ${IMAGE_DEFAULT}
 
 ############################ build local
-.PHONY: image-local
-image-local: kubevpn-linux-amd64
-	docker build -t $(REGISTRY)/kubevpn:${VERSION} -f $(BUILD_DIR)/server/local.Dockerfile .
-	docker tag $(REGISTRY)/kubevpn:${VERSION} $(REGISTRY)/kubevpn:latest
-	docker push $(REGISTRY)/kubevpn:${VERSION}
+.PHONY: container-local
+container-local: kubevpn-linux-amd64
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./bin/envoy-xds-server ./cmd/mesh
+	docker build -t ${IMAGE} -f $(BUILD_DIR)/local.Dockerfile .
+	docker push ${IMAGE}
+	docker tag ${IMAGE} ${IMAGE_DEFAULT}
+	docker push ${IMAGE_DEFAULT}
 
-.PHONY: image-mesh-local
-image-mesh-local:
-	docker build -t $(REGISTRY)/kubevpn-mesh:${VERSION} -f $(BUILD_DIR)/mesh/local.Dockerfile .
-	docker tag $(REGISTRY)/kubevpn-mesh:${VERSION} $(REGISTRY)/kubevpn-mesh:latest
-	docker push $(REGISTRY)/kubevpn-mesh:${VERSION}
-
-.PHONY: image-control-plane-local
-image-control-plane-local:
-	docker build -t $(REGISTRY)/envoy-xds-server:${VERSION} -f $(BUILD_DIR)/control_plane/local.Dockerfile .
-	docker tag $(REGISTRY)/envoy-xds-server:${VERSION} $(REGISTRY)/envoy-xds-server:latest
-	docker push $(REGISTRY)/envoy-xds-server:${VERSION}
diff --git a/build/server/Dockerfile b/build/Dockerfile
similarity index 68%
rename from build/server/Dockerfile
rename to build/Dockerfile
index 437c7d0b..fe50b4cd 100644
--- a/build/server/Dockerfile
+++ b/build/Dockerfile
@@ -1,5 +1,6 @@
 ARG BASE=github.com/wencaiwulue/kubevpn
 
+FROM envoyproxy/envoy:v1.21.1 AS envoy
 FROM golang:1.18 AS builder
 
 COPY . /go/src/$BASE
@@ -8,6 +9,8 @@ WORKDIR /go/src/$BASE
 
 RUN go env -w GO111MODULE=on && go env -w GOPROXY=https://goproxy.cn,direct
 RUN make kubevpn-linux-amd64
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o bin/envoy-xds-server /go/src/$BASE/cmd/mesh
+
 
 FROM ubuntu:latest
 
@@ -18,4 +21,6 @@ RUN apt-get clean && apt-get update && apt-get install -y wget dnsutils vim curl
 
 WORKDIR /app
 
-COPY --from=builder /go/src/$BASE/bin/kubevpn-linux-amd64 /usr/local/bin/kubevpn
\ No newline at end of file
+COPY --from=builder /go/src/$BASE/bin/kubevpn-linux-amd64 /usr/local/bin/kubevpn
+COPY --from=builder /go/src/$BASE/bin/envoy-xds-server /bin/envoy-xds-server
+COPY --from=envoy /usr/local/bin/envoy /usr/local/bin/envoy
\ No newline at end of file
diff --git a/build/control_plane/Dockerfile b/build/control_plane/Dockerfile
deleted file mode 100644
index 39ab14cd..00000000
--- a/build/control_plane/Dockerfile
+++ /dev/null
@@ -1,21 +0,0 @@
-ARG BASE=github.com/wencaiwulue/kubevpn
-
-FROM golang:1.18 AS builder
-
-COPY . /go/src/$BASE
-
-WORKDIR /go/src/$BASE
-
-RUN go env -w GO111MODULE=on && go env -w GOPROXY=https://goproxy.cn,direct
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o envoy-xds-server /go/src/$BASE/cmd/mesh
-
-FROM ubuntu:latest
-
-RUN sed -i s@/security.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list \
-    && sed -i s@/archive.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list
-RUN apt-get clean && apt-get update && apt-get install -y wget dnsutils vim curl  \
-    net-tools iptables iputils-ping lsof iproute2 tcpdump
-
-WORKDIR /app
-
-COPY --from=builder /go/src/$BASE/envoy-xds-server /bin/envoy-xds-server
\ No newline at end of file
diff --git a/build/control_plane/local.Dockerfile b/build/local.Dockerfile
similarity index 63%
rename from build/control_plane/local.Dockerfile
rename to build/local.Dockerfile
index e6ce4449..758d6529 100644
--- a/build/control_plane/local.Dockerfile
+++ b/build/local.Dockerfile
@@ -1,3 +1,4 @@
+FROM envoyproxy/envoy:v1.21.1 AS envoy
 FROM ubuntu:latest
 
 RUN sed -i s@/security.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list \
@@ -7,4 +8,6 @@ RUN apt-get clean && apt-get update && apt-get install -y wget dnsutils vim curl
 
 WORKDIR /app
 
-COPY bin/envoy-xds-server /bin/envoy-xds-server
\ No newline at end of file
+COPY bin/kubevpn-linux-amd64 /usr/local/bin/kubevpn
+COPY bin/envoy-xds-server /bin/envoy-xds-server
+COPY --from=envoy /usr/local/bin/envoy /usr/local/bin/envoy
\ No newline at end of file
diff --git a/build/mesh/Dockerfile b/build/mesh/Dockerfile
deleted file mode 100644
index 868ad5a4..00000000
--- a/build/mesh/Dockerfile
+++ /dev/null
@@ -1,7 +0,0 @@
-FROM envoyproxy/envoy:v1.21.1
-
-WORKDIR /app
-RUN sed -i s@/security.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list \
-    && sed -i s@/archive.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list
-RUN apt-get clean && apt-get update && apt-get install -y wget dnsutils vim curl  \
-    net-tools iptables iputils-ping lsof iproute2 tcpdump
\ No newline at end of file
diff --git a/build/server/local.Dockerfile b/build/server/local.Dockerfile
deleted file mode 100644
index 89b9dba9..00000000
--- a/build/server/local.Dockerfile
+++ /dev/null
@@ -1,10 +0,0 @@
-FROM ubuntu:latest
-
-RUN sed -i s@/security.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list \
-    && sed -i s@/archive.ubuntu.com/@/mirrors.aliyun.com/@g /etc/apt/sources.list
-RUN apt-get clean && apt-get update && apt-get install -y wget dnsutils vim curl  \
-    net-tools iptables iputils-ping lsof iproute2 tcpdump
-
-WORKDIR /app
-
-COPY bin/kubevpn-linux-amd64 /usr/local/bin/kubevpn
\ No newline at end of file
diff --git a/cmd/kubevpn/cmds/connect.go b/cmd/kubevpn/cmds/connect.go
index bf9d79ff..c6fa214d 100644
--- a/cmd/kubevpn/cmds/connect.go
+++ b/cmd/kubevpn/cmds/connect.go
@@ -26,6 +26,7 @@ func init() {
 	connectCmd.PersistentFlags().StringArrayVar(&connect.Workloads, "workloads", []string{}, "workloads, like: pods/tomcat, deployment/nginx, replicaset/tomcat...")
 	connectCmd.Flags().StringToStringVarP(&connect.Headers, "headers", "H", map[string]string{}, "headers, format is k=v, like: k1=v1,k2=v2")
 	connectCmd.Flags().BoolVar(&config.Debug, "debug", false, "true/false")
+	connectCmd.Flags().StringVar(&config.Image, "image", config.Image, "use this image to startup container")
 	RootCmd.AddCommand(connectCmd)
 }
 
diff --git a/cmd/kubevpn/cmds/version.go b/cmd/kubevpn/cmds/version.go
index fd42658b..98ca006a 100644
--- a/cmd/kubevpn/cmds/version.go
+++ b/cmd/kubevpn/cmds/version.go
@@ -17,6 +17,7 @@ var (
 	GitCommit = ""
 	BuildTime = ""
 	Branch    = ""
+	Version   = "latest"
 )
 
 func reformatDate(buildTime string) string {
@@ -33,7 +34,8 @@ var versionCmd = &cobra.Command{
 	Long:  `This is the version of KubeVPN`,
 	Run: func(cmd *cobra.Command, args []string) {
 		fmt.Printf("KubeVPN: CLI\n")
-		fmt.Printf("    Version: %s\n", config.Version)
+		fmt.Printf("    Version: %s\n", Version)
+		fmt.Printf("    Image: %s\n", config.Image)
 		fmt.Printf("    Branch: %s\n", Branch)
 		fmt.Printf("    Git commit: %s\n", GitCommit)
 		fmt.Printf("    Built time: %s\n", reformatDate(BuildTime))
@@ -45,9 +47,9 @@ var versionCmd = &cobra.Command{
 func init() {
 	RootCmd.AddCommand(versionCmd)
 	// Prefer version number inserted at build using --ldflags
-	if config.Version == "" {
+	if Version == "" {
 		if i, ok := debug.ReadBuildInfo(); ok {
-			config.Version = i.Main.Version
+			Version = i.Main.Version
 		}
 	}
 }
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 0967bc65..fe575ff6 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -29,12 +29,8 @@ const (
 )
 
 var (
-	// Version inject --ldflags -X
-	Version = "latest"
-
-	ImageServer       = "naison/kubevpn:" + Version
-	ImageMesh         = "naison/kubevpn-mesh:" + Version
-	ImageControlPlane = "naison/envoy-xds-server:" + Version
+	// Image inject --ldflags -X
+	Image = "docker.io/naison/kubevpn:latest"
 )
 
 var CIDR *net.IPNet
diff --git a/pkg/exchange/controller.go b/pkg/exchange/controller.go
index 227ca0bb..f3b14697 100644
--- a/pkg/exchange/controller.go
+++ b/pkg/exchange/controller.go
@@ -24,7 +24,7 @@ func AddContainer(spec *corev1.PodSpec, c util.PodRouteConfig) {
 	zero := int64(0)
 	spec.Containers = append(spec.Containers, corev1.Container{
 		Name:  config.ContainerSidecarVPN,
-		Image: config.ImageServer,
+		Image: config.Image,
 		Env: []corev1.EnvVar{
 			{
 				Name:  "LocalTunIP",
diff --git a/pkg/handler/remote.go b/pkg/handler/remote.go
index 89a1e37a..4f97e7d9 100644
--- a/pkg/handler/remote.go
+++ b/pkg/handler/remote.go
@@ -128,7 +128,7 @@ func CreateOutboundPod(clientset *kubernetes.Clientset, namespace string, traffi
 					Containers: []v1.Container{
 						{
 							Name:    config.ContainerSidecarVPN,
-							Image:   config.ImageServer,
+							Image:   config.Image,
 							Command: []string{"/bin/sh", "-c"},
 							Args: []string{`
 sysctl net.ipv4.ip_forward=1
@@ -173,7 +173,7 @@ kubevpn serve -L "tcp://:10800" -L "tun://:8422?net=${TrafficManagerIP}" --debug
 						},
 						{
 							Name:    config.ContainerSidecarControlPlane,
-							Image:   config.ImageControlPlane,
+							Image:   config.Image,
 							Command: []string{"envoy-xds-server"},
 							Args:    []string{"--watchDirectoryFileName", "/etc/envoy/envoy-config.yaml"},
 							Ports: []v1.ContainerPort{{
diff --git a/pkg/mesh/controller.go b/pkg/mesh/controller.go
index 54030208..c0a959ae 100644
--- a/pkg/mesh/controller.go
+++ b/pkg/mesh/controller.go
@@ -27,7 +27,7 @@ func AddMeshContainer(spec *v1.PodTemplateSpec, nodeId string, c util.PodRouteCo
 	t := true
 	spec.Spec.Containers = append(spec.Spec.Containers, v1.Container{
 		Name:    config.ContainerSidecarVPN,
-		Image:   config.ImageServer,
+		Image:   config.Image,
 		Command: []string{"/bin/sh", "-c"},
 		Args: []string{`
 sysctl net.ipv4.ip_forward=1
@@ -79,7 +79,7 @@ kubevpn serve -L "tun:/${TrafficManagerRealIP}:8422?net=${InboundPodTunIP}&route
 	})
 	spec.Spec.Containers = append(spec.Spec.Containers, v1.Container{
 		Name:    config.ContainerSidecarEnvoyProxy,
-		Image:   config.ImageMesh,
+		Image:   config.Image,
 		Command: []string{"envoy", "-l", "debug", "--base-id", "1", "--config-yaml"},
 		Args: []string{
 			fmt.Sprintf(s, nodeId, nodeId, c.TrafficManagerRealIP),
diff --git a/pkg/util/cidr.go b/pkg/util/cidr.go
index 2f4f505d..8b808b5a 100644
--- a/pkg/util/cidr.go
+++ b/pkg/util/cidr.go
@@ -149,7 +149,7 @@ func GetCidrFromCNI(clientset *kubernetes.Clientset, restclient *rest.RESTClient
 			Containers: []v12.Container{
 				{
 					Name:    name,
-					Image:   config.ImageServer,
+					Image:   config.Image,
 					Command: []string{"tail", "-f", "/dev/null"},
 					Resources: v12.ResourceRequirements{
 						Requests: map[v12.ResourceName]resource.Quantity{