diff --git a/krm-functions/cloud-init/Dockerfile b/krm-functions/cloud-init/Dockerfile
index 5b4f86f2..eaa107c7 100644
--- a/krm-functions/cloud-init/Dockerfile
+++ b/krm-functions/cloud-init/Dockerfile
@@ -1,5 +1,6 @@
 ARG GO_IMAGE=quay.io/airshipit/golang:1.16.8-buster
-ARG RELEASE_IMAGE=quay.io/airshipit/alpine:3.13.5
+ARG RELEASE_IMAGE=quay.io/airshipit/image-builder:k8s-1.21-latest-ubuntu_focal
+
 FROM ${GO_IMAGE} as builder
 ARG GOPROXY=""
 
@@ -28,5 +29,4 @@ RUN make ${MAKE_TARGET}
 FROM ${RELEASE_IMAGE} as release
 ARG MAKE_TARGET=bin/cloud-init
 COPY --from=builder /usr/src/airshipctl/${MAKE_TARGET} /usr/local/bin/config-function
-USER 65534
 CMD ["/usr/local/bin/config-function"]
diff --git a/krm-functions/cloud-init/main.go b/krm-functions/cloud-init/main.go
index 3870093b..c2bbf16d 100644
--- a/krm-functions/cloud-init/main.go
+++ b/krm-functions/cloud-init/main.go
@@ -17,7 +17,9 @@ package main
 import (
 	"errors"
 	"fmt"
+	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
 
 	"sigs.k8s.io/kustomize/api/provider"
@@ -67,6 +69,15 @@ func docFromRNode(rnode *yaml.RNode) (document.Document, error) {
 	return collection[0], nil
 }
 
+func runCmd(cmd string, opts ...string) error {
+	c := exec.Command(cmd, opts...)
+	// allows to observe realtime output from script
+	w := io.Writer(os.Stderr)
+	c.Stdout = w
+	c.Stderr = w
+	return c.Run()
+}
+
 func main() {
 	fn := func(rl *framework.ResourceList) error {
 		functionConfigDocument, err := docFromRNode(rl.FunctionConfig)
@@ -113,7 +124,7 @@ func main() {
 		}
 
 		rl.Items = []*yaml.RNode{}
-		return nil
+		return runCmd("/usr/bin/local/entrypoint.sh")
 	}
 	cmd := command.Build(framework.ResourceListProcessorFunc(fn), command.StandaloneEnabled, false)
 	if err := cmd.Execute(); err != nil {
diff --git a/manifests/phases/executors.yaml b/manifests/phases/executors.yaml
index 0a2dc313..133e05ee 100644
--- a/manifests/phases/executors.yaml
+++ b/manifests/phases/executors.yaml
@@ -252,7 +252,7 @@ spec:
 apiVersion: airshipit.org/v1alpha1
 kind: GenericContainer
 metadata:
-  name: iso-cloud-init-data
+  name: iso-build-image
   labels:
     airshipit.org/deploy-k8s: "false"
 spec:
@@ -263,6 +263,19 @@ spec:
       src: /srv/images
       dst: /config
       rw: true
+  envVars:
+    - IMAGE_TYPE=iso
+    - BUILDER_CONFIG=/config/builder-conf.yaml
+    - USER_DATA_FILE=user-data
+    - NET_CONFIG_FILE=network-data
+    - OUTPUT_FILE_NAME=ephemeral.iso
+    - OUTPUT_METADATA_FILE_NAME=output1-metadata.yaml
+    - http_proxy
+    - https_proxy
+    - HTTP_PROXY
+    - HTTPS_PROXY
+    - no_proxy
+    - NO_PROXY
 config: |
   apiVersion: airshipit.org/v1alpha1
   kind: IsoConfiguration
@@ -281,47 +294,6 @@ config: |
     outputFileName: ephemeral.iso
   container:
     volume: /srv/images:/config # for compatibility with image-builder
-
----
-apiVersion: airshipit.org/v1alpha1
-kind: GenericContainer
-metadata:
-  name: iso-build-image
-  labels:
-    airshipit.org/deploy-k8s: "false"
-spec:
-  type: airship
-  airship:
-    privileged: true
-    containerRuntime: docker
-    cmd:
-      - /bin/bash
-      - -c
-      - /usr/bin/local/entrypoint.sh 1>&2
-  image: quay.io/airshipit/image-builder:k8s-1.19-latest-ubuntu_focal
-  mounts:
-    - type: bind
-      src: /srv/images
-      dst: /config
-      rw: true
-  envVars:
-    - IMAGE_TYPE=iso
-    - BUILDER_CONFIG=/config/builder-conf.yaml
-    - USER_DATA_FILE=user-data
-    - NET_CONFIG_FILE=network-data
-    - OUTPUT_FILE_NAME=ephemerial.iso
-    - OUTPUT_METADATA_FILE_NAME=output-metadata.yaml
-    - http_proxy
-    - https_proxy
-    - HTTP_PROXY
-    - HTTPS_PROXY
-    - no_proxy
-    - NO_PROXY
-config: |
-  apiVersion: airshipit.org/v1alpha1
-  kind: DoesNotMatter
-  metadata:
-    name: isogen
 ---
 apiVersion: airshipit.org/v1alpha1
 kind: GenericContainer
diff --git a/manifests/phases/phases.yaml b/manifests/phases/phases.yaml
index 44ab8cbf..627830d7 100644
--- a/manifests/phases/phases.yaml
+++ b/manifests/phases/phases.yaml
@@ -249,17 +249,6 @@ config:
 ---
 apiVersion: airshipit.org/v1alpha1
 kind: Phase
-metadata:
-  name: iso-cloud-init-data
-config:
-  executorRef:
-    apiVersion: airshipit.org/v1alpha1
-    kind: GenericContainer
-    name: iso-cloud-init-data
-  documentEntryPoint: ephemeral/bootstrap
----
-apiVersion: airshipit.org/v1alpha1
-kind: Phase
 metadata:
   name: iso-build-image
 config:
@@ -267,6 +256,7 @@ config:
     apiVersion: airshipit.org/v1alpha1
     kind: GenericContainer
     name: iso-build-image
+  documentEntryPoint: ephemeral/bootstrap
 ---
 apiVersion: airshipit.org/v1alpha1
 kind: Phase
diff --git a/manifests/phases/replacements/versions.yaml b/manifests/phases/replacements/versions.yaml
index 9d8c924a..20dd99f3 100644
--- a/manifests/phases/replacements/versions.yaml
+++ b/manifests/phases/replacements/versions.yaml
@@ -6,15 +6,4 @@ metadata:
     config.kubernetes.io/function: |-
       container:
         image: localhost/replacement-transformer
-replacements:
-- source:
-    objref:
-      kind: VersionsCatalogue
-      name: versions-airshipctl
-    fieldref: spec.images.image_builder.image_builder.image_builder.image
-  target:
-    objref:
-      kind: GenericContainer
-      name: iso-build-image
-    fieldrefs: ["spec.image"]
-
+replacements: []
diff --git a/manifests/type/gating/phases/plan.yaml b/manifests/type/gating/phases/plan.yaml
index 95d408eb..ac9b7421 100644
--- a/manifests/type/gating/phases/plan.yaml
+++ b/manifests/type/gating/phases/plan.yaml
@@ -131,7 +131,6 @@ metadata:
   name: iso
 description: "Runs phases to build iso image"
 phases:
-  - name: iso-cloud-init-data
   - name: iso-build-image
 validation:
   kindsToSkip:
diff --git a/tools/deployment/24_build_images.sh b/tools/deployment/24_build_images.sh
index f45ecfad..78d0f0bd 100755
--- a/tools/deployment/24_build_images.sh
+++ b/tools/deployment/24_build_images.sh
@@ -31,7 +31,7 @@ sudo chown -R ${USER_NAME} ${IMAGE_DIR}
 unset IFS
 for plan in $IMAGE_PHASE_PLANS; do
   echo "Build phase plan: $plan"
-  airshipctl plan run $plan --debug
+  sudo --preserve-env=SOPS_IMPORT_PGP airshipctl plan run $plan --debug
 done
 
 echo "List generated images"