diff --git a/gerrit-github-sync/BUILD b/gerrit-github-sync/BUILD
deleted file mode 100644
index 0992c67..0000000
--- a/gerrit-github-sync/BUILD
+++ /dev/null
@@ -1,28 +0,0 @@
-# Copyright 2015 The Bazel Authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# A slave for polling and syncing gerrit and github
-load("@io_bazel_rules_docker//docker:docker.bzl", "docker_build")
-
-docker_build(
-    name = "gerrit-github-sync",
-    base = "//base:ubuntu-xenial-amd64-ssh",
-    entrypoint = [
-        "/bin/bash",
-        "/gerrit-github-sync.sh",
-    ],
-    files = ["gerrit-github-sync.sh"],
-    visibility = ["//visibility:public"],
-    volumes = ["/opt/secrets"],
-)
diff --git a/gitsync/Dockerfile b/gitsync/Dockerfile
new file mode 100644
index 0000000..dc9a386
--- /dev/null
+++ b/gitsync/Dockerfile
@@ -0,0 +1,37 @@
+FROM ubuntu:latest
+
+# https://cloud.google.com/sdk/docs/quickstart-debian-ubuntu
+RUN apt-get update \
+ && apt-get install -y \
+        curl \
+        git \
+        lsb-release \
+        openssh-client \
+ && export CLOUD_SDK_REPO="cloud-sdk-$(lsb_release -c -s)" \
+ && echo "deb http://packages.cloud.google.com/apt $CLOUD_SDK_REPO main" > /etc/apt/sources.list.d/google-cloud-sdk.list \
+ && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - \
+ && apt-get update \
+ && apt-get install -y google-cloud-sdk \
+ && gcloud config set core/disable_usage_reporting true \
+ && gcloud config set component_manager/disable_update_check true \
+ && gcloud --version \
+ && rm -rf /var/lib/apt/lists/*
+
+# TODO(philwo) is this still needed?
+# RUN (cd /usr/share/ca-certificates && find . -type f -name '*.crt' \
+#     | sed -e 's|^\./||') > /etc/ca-certificates.conf \
+#  && update-ca-certificates
+
+RUN useradd --create-home --user-group --shell /bin/bash gitsync
+
+RUN mkdir -p /home/gitsync/.ssh
+COPY ssh_config /home/gitsync/.ssh/config
+COPY known_hosts /home/gitsync/.ssh/known_hosts
+COPY gitsync.sh /home/gitsync/gitsync.sh
+RUN chown -R gitsync:gitsync /home/gitsync
+
+USER gitsync
+RUN git config --global http.cookiefile /home/gitsync/.gitcookies
+
+WORKDIR /home/gitsync
+ENTRYPOINT [ "/home/gitsync/gitsync.sh" ]
diff --git a/gitsync/README.md b/gitsync/README.md
new file mode 100644
index 0000000..4d3aa87
--- /dev/null
+++ b/gitsync/README.md
@@ -0,0 +1,23 @@
+# Building the Docker container
+
+```
+$ docker build -t gcr.io/bazel-public/gitsync .
+$ docker push gcr.io/bazel-public/gitsync
+```
+
+# Starting the VM that hosts the Docker container
+
+```
+$ gcloud beta compute instances create-with-container \
+    --boot-disk-size 200GB \
+    --container-image gcr.io/bazel-public/gitsync:latest \
+    --machine-type n1-standard-1 \
+    --network buildkite \
+    --zone europe-west1-d \
+    --image-project cos-cloud \
+    --image-family cos-stable \
+    --metadata cos-metrics-enabled=true \
+    --scopes cloud-platform \
+    --service-account gitsync@bazel-public.iam.gserviceaccount.com \
+    gitsync
+```
diff --git a/gerrit-github-sync/gerrit-github-sync.sh b/gitsync/gitsync.sh
old mode 100644
new mode 100755
similarity index 67%
rename from gerrit-github-sync/gerrit-github-sync.sh
rename to gitsync/gitsync.sh
index 55ed4fc..ddb8281
--- a/gerrit-github-sync/gerrit-github-sync.sh
+++ b/gitsync/gitsync.sh
@@ -27,72 +27,60 @@
     "https://bazel.googlesource.com/bazel-toolchains git@github.com:bazelbuild/bazel-toolchains.git bazel-toolchains true master"
 )
 
-# Install certificates
-(cd /usr/share/ca-certificates && find . -type f -name '*.crt' \
-    | sed -e 's|^\./||') > /etc/ca-certificates.conf
-update-ca-certificates
+set -euxo pipefail
 
-# Set-up deploy keys
-mkdir -p ~/.ssh
-cat >~/.ssh/config <<'EOF'
-Host               github.com
-    Hostname       github.com
-    User           git
-    IdentityFile   /opt/secrets/github_id_rsa
-    IdentitiesOnly yes
-    StrictHostKeyChecking no
-EOF
+# Download & decrypt gitcookies.
+gsutil cat "gs://bazel-encrypted-secrets/gitsync-cookies.enc" | \
+    gcloud kms decrypt --location "global" --keyring "buildkite" --key "gitsync-cookies-key" --plaintext-file "-" --ciphertext-file "-" \
+    > /home/gitsync/.gitcookies
+chmod 0600 /home/gitsync/.gitcookies
 
-git config --global http.cookiefile /opt/secrets/gerritcookies
-
-set -eu
-
-cd /tmp
-
-function log() {
-  echo "[$(date -u '+%Y-%m-%d %H:%M:%S')] $*"
-}
+# Download & decrypt GitHub SSH key.
+gsutil cat "gs://bazel-encrypted-secrets/gitsync-ssh.enc" | \
+    gcloud kms decrypt --location "global" --keyring "buildkite" --key "gitsync-ssh-key" --plaintext-file "-" --ciphertext-file "-" \
+    > /home/gitsync/.ssh/id_rsa
+chmod 0600 /home/gitsync/.ssh/id_rsa
 
 function clone() {
-  git clone $1 $3
-  pushd $3
-  git remote add destination $2
+  git clone "$1" "$3"
+  pushd "$3"
+  git remote add destination "$2"
   popd
 }
 
 function sync_branch() {
-  log "sync_branch $*"
+  echo "sync_branch $*"
   local branch="$1"
   local bidirectional="$2"
-  git checkout origin/${branch} -B ${branch} || {
+  git checkout "origin/${branch}" -B "${branch}" || {
     echo "Failed to checkout ${branch}, aborting sync..."
     return 1
   }
 
-  log "Origin branch is $(git rev-parse origin/master), destination is $(git rev-parse destination/master)"
+  echo "Origin branch is $(git rev-parse origin/master), destination is $(git rev-parse destination/master)"
   if $bidirectional; then
-    git rebase destination/${branch} || {
+    git rebase "destination/${branch}" || {
       echo "Failed to rebase ${branch} from destination, aborting sync..."
       git rebase --abort &>/dev/null || true
       return 1
     }
-    git push -f origin ${branch} || {
+    git push -f origin "${branch}" || {
       echo "Failed to force pushed to origin, aborting sync..."
       return 1
     }
   fi
 
-  log "New head for destination is $(git rev-parse HEAD)"
-  git push destination ${branch} || {
+  echo "New head for destination is $(git rev-parse HEAD)"
+  git push destination "${branch}" || {
     echo "Failed to push to destination..."
     return 1
   }
 }
 
 function sync() {
-  log "sync $*"
+  echo "sync $*"
   local bidirectional="$4"
-  pushd $3
+  pushd "$3"
   shift 4
   git fetch origin
   git fetch destination
diff --git a/gitsync/known_hosts b/gitsync/known_hosts
new file mode 100644
index 0000000..31cdb7d
--- /dev/null
+++ b/gitsync/known_hosts
@@ -0,0 +1 @@
+github.com,192.30.253.112,192.30.253.113 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
diff --git a/gitsync/ssh_config b/gitsync/ssh_config
new file mode 100644
index 0000000..4db8851
--- /dev/null
+++ b/gitsync/ssh_config
@@ -0,0 +1,5 @@
+Host github.com
+    Hostname github.com
+    User git
+    IdentityFile /home/gitsync/.ssh/id_rsa
+    IdentitiesOnly yes