diff --git a/common.nix b/common.nix
index 498db5e..ba9eb03 100644
--- a/common.nix
+++ b/common.nix
@@ -83,7 +83,6 @@
     jq
     _7zz
     sbctl
-    dracut
     openssl
     grub2_efi
   ];
@@ -129,48 +128,74 @@
       };
     };
   };
-  systemd.services.pxeboot = {
-    serviceConfig.Type = "oneshot";
-    wantedBy = [ "multi-user.target" ];
-    path = with pkgs; [ xz dracut grub2_efi util-linux ];
-    script = let
-      grubCfg = pkgs.writeText "grub.cfg" ''
-        set timeout=10
-        set path=(http,$net_default_server)/local/boot/pxe
-        set nfs="rw ifname=ens0:$net_default_mac ip=$net_default_ip::$net_default_server:255.255.0.0::ens0:none root=nfs4:$net_default_server:/srv/nfs"
-        menuentry Arch {
-          linux $path/arch/linux $nfs/arch/root
-          initrd $path/arch/initramfs
-        }
-        menuentry Fedora {
-          linux $path/fedora/linux $nfs/fedora/root selinux=0
-          initrd $path/fedora/initramfs
-        }
-      '';
-    in ''
-      if [ ! -e /srv/tftp/grubx64.efi ]; then
-        echo "Building grub"
-        grub-mkstandalone -O x86_64-efi --compress=xz --modules=efinet -o /srv/tftp/grubx64.efi /boot/grub/grub.cfg=${grubCfg}
-      fi
-      for distro in arch:arch/x86_64/airootfs.sfs fedora:LiveOS/squashfs.img; do
-        rootfs=''${distro#*:}
-        distro=''${distro%%:*}
-        cd /srv/nfs/$distro
-        mkdir -p loop lower upper work root
-        mountpoint -q loop || mount $distro.iso loop
-        mountpoint -q lower || mount loop/$rootfs lower
-        mountpoint -q root || mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work,nfs_export=on root
-        cd /srv/http/local/boot/pxe
-        if [ ! -e $distro ]; then
-          mkdir $distro
-          modsDir=$OLDPWD/lower/usr/lib/modules/*
-          cp $modsDir/vmlinuz $distro/linux
-          dracut -Nvm "network-manager nfs" --zstd --kver $(basename $modsDir) -k $modsDir $distro/initramfs
-          chmod -R 640 $distro
-          chgrp -R php $distro
-          chmod ug+x $distro
+  virtualisation.oci-containers.containers.fedora-dracut = {
+    autoStart = false;
+    entrypoint = "bash";
+    autoRemoveOnStop = false;
+    image = "docker.io/fedora:latest";
+    cmd = [ "/data/workdir/entry.sh" ];
+    volumes = [
+      "/var/lib/podman-dracut:/data/workdir"
+      "/srv/nfs/arch/lower:/data/ro-arch:ro"
+      "/srv/nfs/fedora/lower:/data/ro-fedora:ro"
+    ];
+  };
+  systemd = {
+    tmpfiles.rules = [ "d /var/lib/podman-dracut 0755 root root -" ];
+    services.pxeboot = {
+      serviceConfig.Type = "oneshot";
+      wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ xz grub2_efi util-linux ];
+      script = let
+        grubCfg = pkgs.writeText "grub.cfg" ''
+          set timeout=10
+          set path=(http,$net_default_server)/local/boot/pxe
+          set nfs="rw ifname=ens0:$net_default_mac ip=$net_default_ip::$net_default_server:255.255.0.0::ens0:none root=nfs4:$net_default_server:/srv/nfs"
+          . $path/grub.cfg
+        '';
+      in ''
+        cd /srv/tftp
+        if [ ! -e grubx64.efi ]; then
+          grub-mkstandalone -O x86_64-efi --compress=xz --modules=efinet -o grubx64.efi /boot/grub/grub.cfg=${grubCfg}
         fi
-      done
-    '';
+        cat > /var/lib/podman-dracut/entry.sh <<'EOF'
+          set -e
+          dnf install -y dracut-network nfs-utils
+          cd /data/workdir
+          target=$(cat target)
+          modsDir=../ro-$target/usr/lib/modules/*
+          mkdir $target
+          cp $modsDir/vmlinuz $target
+          dracut -Nm "network-manager nfs" --zstd -k $modsDir --kver $(basename $modsDir) $target/initramfs
+        EOF
+        for distro in arch:arch/x86_64/airootfs.sfs: fedora:LiveOS/squashfs.img:selinux=0; do
+          cmdline=''${distro##*:}
+          distro=''${distro%:*}
+          rootfs=''${distro##*:}
+          distro=''${distro%:*}
+          cd /srv/nfs/$distro
+          mkdir -p loop lower upper work root
+          mountpoint -q loop || mount $distro.iso loop
+          mountpoint -q lower || mount loop/$rootfs lower
+          mountpoint -q root || mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work,nfs_export=on root
+          cd /srv/http/local/boot/pxe
+          if [ ! -e $distro ]; then
+            echo $distro > /var/lib/podman-dracut/target
+            systemctl --wait restart podman-fedora-dracut.service
+            mv /var/lib/podman-dracut/$distro .
+          fi
+          if [ ! -e .grub.cfg.lock ]; then
+            echo "menuentry $distro {
+              linux \$path/$distro/vmlinuz \$nfs/$distro/root $cmdline
+              initrd \$path/$distro/initramfs
+            }" >> grub.cfg
+          fi
+        done
+        touch .grub.cfg.lock
+        chmod -R 640 .
+        chgrp -R php .
+        chmod ug+x $(find -type d)
+      '';
+    };
   };
 }