diff --git a/ci/images/ci-image/Dockerfile b/ci/images/ci-image/Dockerfile
index 78173928..344ba8c1 100644
--- a/ci/images/ci-image/Dockerfile
+++ b/ci/images/ci-image/Dockerfile
@@ -2,7 +2,10 @@ FROM ubuntu:focal-20211006
 
 ADD setup.sh /setup.sh
 ADD get-jdk-url.sh /get-jdk-url.sh
+ADD get-docker-url.sh /get-docker-url.sh
 RUN ./setup.sh java8
 
 ENV JAVA_HOME /opt/openjdk
 ENV PATH $JAVA_HOME/bin:$PATH
+ADD docker-lib.sh /bin/docker-lib.sh
+ADD start-docker.sh /bin/start-docker.sh
diff --git a/ci/images/docker-lib.sh b/ci/images/docker-lib.sh
new file mode 100755
index 00000000..eac9c2ee
--- /dev/null
+++ b/ci/images/docker-lib.sh
@@ -0,0 +1,97 @@
+# Based on: https://github.com/concourse/docker-image-resource/blob/master/assets/common.sh
+
+DOCKER_LOG_FILE=${DOCKER_LOG_FILE:-/tmp/docker.log}
+SKIP_PRIVILEGED=${SKIP_PRIVILEGED:-false}
+STARTUP_TIMEOUT=${STARTUP_TIMEOUT:-120}
+
+sanitize_cgroups() {
+  mkdir -p /sys/fs/cgroup
+  mountpoint -q /sys/fs/cgroup || \
+    mount -t tmpfs -o uid=0,gid=0,mode=0755 cgroup /sys/fs/cgroup
+
+  mount -o remount,rw /sys/fs/cgroup
+
+  sed -e 1d /proc/cgroups | while read sys hierarchy num enabled; do
+    if [ "$enabled" != "1" ]; then
+      # subsystem disabled; skip
+      continue
+    fi
+
+    grouping="$(cat /proc/self/cgroup | cut -d: -f2 | grep "\\<$sys\\>")" || true
+    if [ -z "$grouping" ]; then
+      # subsystem not mounted anywhere; mount it on its own
+      grouping="$sys"
+    fi
+
+    mountpoint="/sys/fs/cgroup/$grouping"
+
+    mkdir -p "$mountpoint"
+
+    # clear out existing mount to make sure new one is read-write
+    if mountpoint -q "$mountpoint"; then
+      umount "$mountpoint"
+    fi
+
+    mount -n -t cgroup -o "$grouping" cgroup "$mountpoint"
+
+    if [ "$grouping" != "$sys" ]; then
+      if [ -L "/sys/fs/cgroup/$sys" ]; then
+        rm "/sys/fs/cgroup/$sys"
+      fi
+
+      ln -s "$mountpoint" "/sys/fs/cgroup/$sys"
+    fi
+  done
+
+  if ! test -e /sys/fs/cgroup/systemd ; then
+    mkdir /sys/fs/cgroup/systemd
+    mount -t cgroup -o none,name=systemd none /sys/fs/cgroup/systemd
+  fi
+}
+
+start_docker() {
+  mkdir -p /var/log
+  mkdir -p /var/run
+
+  if [ "$SKIP_PRIVILEGED" = "false" ]; then
+    sanitize_cgroups
+
+    # check for /proc/sys being mounted readonly, as systemd does
+    if grep '/proc/sys\s\+\w\+\s\+ro,' /proc/mounts >/dev/null; then
+      mount -o remount,rw /proc/sys
+    fi
+  fi
+
+  local mtu=$(cat /sys/class/net/$(ip route get 8.8.8.8|awk '{ print $5 }')/mtu)
+  local server_args="--mtu ${mtu}"
+  local registry=""
+
+  server_args="${server_args}"
+
+  if [ -n "$1" ]; then
+    server_args="${server_args} --registry-mirror https://$1"
+  fi
+
+  try_start() {
+    dockerd --data-root /scratch/docker ${server_args} >$DOCKER_LOG_FILE 2>&1 &
+    echo $! > /tmp/docker.pid
+
+    sleep 1
+
+    echo waiting for docker to come up...
+    until docker info >/dev/null 2>&1; do
+      sleep 1
+      if ! kill -0 "$(cat /tmp/docker.pid)" 2>/dev/null; then
+        return 1
+      fi
+    done
+  }
+
+  export server_args DOCKER_LOG_FILE
+  declare -fx try_start
+
+  if ! timeout ${STARTUP_TIMEOUT} bash -ce 'while true; do try_start && break; done'; then
+    echo Docker failed to start within ${STARTUP_TIMEOUT} seconds.
+    return 1
+  fi
+}
diff --git a/ci/images/get-docker-url.sh b/ci/images/get-docker-url.sh
new file mode 100755
index 00000000..c6406c82
--- /dev/null
+++ b/ci/images/get-docker-url.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+version="20.10.11"
+echo "https://download.docker.com/linux/static/stable/x86_64/docker-$version.tgz";
\ No newline at end of file
diff --git a/ci/images/setup.sh b/ci/images/setup.sh
index a2b30b9a..8b6c15ac 100755
--- a/ci/images/setup.sh
+++ b/ci/images/setup.sh
@@ -28,6 +28,21 @@ curl -L ${JDK_URL} | tar zx --strip-components=1
 test -f /opt/openjdk/bin/java
 test -f /opt/openjdk/bin/javac
 
+###########################################################
+# DOCKER
+###########################################################
+cd /
+DOCKER_URL=$( ./get-docker-url.sh )
+curl -L ${DOCKER_URL} | tar zx
+mv /docker/* /bin/
+chmod +x /bin/docker*
+
+export ENTRYKIT_VERSION=0.4.0
+curl -L https://github.com/progrium/entrykit/releases/download/v${ENTRYKIT_VERSION}/entrykit_${ENTRYKIT_VERSION}_Linux_x86_64.tgz | tar zx
+chmod +x entrykit && \
+mv entrykit /bin/entrykit && \
+entrykit --symlink
+
 ###########################################################
 # GRADLE ENTERPRISE
 ###########################################################
diff --git a/ci/images/start-docker.sh b/ci/images/start-docker.sh
new file mode 100755
index 00000000..292aef3b
--- /dev/null
+++ b/ci/images/start-docker.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+source /bin/docker-lib.sh
+start_docker
\ No newline at end of file
diff --git a/ci/pipeline.yml b/ci/pipeline.yml
index 991a6091..16a3ea45 100644
--- a/ci/pipeline.yml
+++ b/ci/pipeline.yml
@@ -1,8 +1,7 @@
 anchors:
-  docker-resource-source: &docker-resource-source
+  docker-hub-task-params: &docker-hub-task-params
     username: ((docker-hub-username))
     password: ((docker-hub-password))
-    tag: ((milestone))
   gradle-enterprise-task-params: &gradle-enterprise-task-params
     GRADLE_ENTERPRISE_ACCESS_KEY: ((gradle_enterprise_secret_access_key))
     GRADLE_ENTERPRISE_CACHE_USERNAME: ((gradle_enterprise_cache_user.username))
@@ -43,7 +42,8 @@ resources:
   type: registry-image
   icon: docker
   source:
-    <<: *docker-resource-source
+    <<: *docker-hub-task-params
+    tag: ((milestone))
     repository: ((docker-hub-organization))/spring-graphql-ci-image
 - name: artifactory-repo
   type: artifactory-resource
@@ -86,6 +86,7 @@ jobs:
       file: git-repo/ci/tasks/build-project.yml
       params:
         BRANCH: ((branch))
+        <<: *docker-hub-task-params
         <<: *gradle-enterprise-task-params
   - put: artifactory-repo
     params: &artifactory-params
diff --git a/ci/scripts/build-project.sh b/ci/scripts/build-project.sh
index 3844d1a3..916c820f 100755
--- a/ci/scripts/build-project.sh
+++ b/ci/scripts/build-project.sh
@@ -4,6 +4,11 @@ set -e
 source $(dirname $0)/common.sh
 repository=$(pwd)/distribution-repository
 
+/bin/start-docker.sh
+if [[ -n $DOCKER_HUB_USERNAME ]]; then
+	echo "$DOCKER_HUB_PASSWORD" | docker login -u $DOCKER_HUB_USERNAME --password-stdin
+fi
+
 pushd git-repo > /dev/null
 ./gradlew -Dorg.gradle.internal.launcher.welcomeMessageEnabled=false --no-daemon --max-workers=4 -PdeploymentRepository=${repository} build publishAllPublicationsToDeploymentRepository
 popd > /dev/null