diff --git a/containers/fedora/Containerfile b/containers/fedora/Containerfile
index df54734..d5406ae 100644
--- a/containers/fedora/Containerfile
+++ b/containers/fedora/Containerfile
@@ -5,16 +5,16 @@ RUN dnf update -y && \
   dnf copr enable -y atim/lazygit && \
   dnf -y install procps ping bash-completion glibc-langpack-en \
     host-spawn dbus-launch \
-    zoxide git npm neovim awk jq unzip fd-find lazygit
+    zoxide git npm neovim awk jq unzip fd-find lazygit && \
+  dnf clean all
 
 # === setup user ===
 RUN useradd -ms /bin/bash user && \
-  usermod -aG wheel user && sed -i '/NOPASSWD/s/^#//g' /etc/sudoers && \
-  mkdir -p /run/user/1000 && chown user:user /run/user/1000
+  echo 'user ALL=NOPASSWD: ALL' > /etc/sudoers && \
+  install -d -o user -g user /run/user/1000 /home/user/.config /home/user/.local /home/user/.cache
 
 USER user
 WORKDIR /home/user
-RUN mkdir .config .local .cache
 
 RUN git clone https://git.plabble.org/Job79/neovim-config.git .config/nvim
 COPY --chown=user:user config/bashrc .bashrc
diff --git a/containers/infra/Containerfile b/containers/infra/Containerfile
index e5f8a27..43540f6 100644
--- a/containers/infra/Containerfile
+++ b/containers/infra/Containerfile
@@ -2,9 +2,8 @@ ARG TAG
 FROM git.plabble.org/job79/fedora:${TAG}
 USER root
 
-RUN dnf -y install kubectl k9s openssl age
-RUN curl -sL https://talos.dev/install | sh
-RUN curl -s https://fluxcd.io/install.sh | bash
-RUN dnf -y install "$(curl -s https://api.github.com/repos/getsops/sops/releases/latest | jq -r '.assets[] | select(.name | test("sops-.*.x86_64.rpm$")) | .browser_download_url')"
+RUN dnf -y install kubectl k9s openssl age "$(curl -s https://api.github.com/repos/getsops/sops/releases/latest | jq -r '.assets[] | select(.name | test("sops-.*.x86_64.rpm$")) | .browser_download_url')" && \
+  curl -sL https://talos.dev/install | sh && \
+  curl -s https://fluxcd.io/install.sh | bash
 
 USER user