diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 60a2b62..8633a27 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,26 +15,35 @@ jobs:
       fail-fast: false
       matrix:
         epics-target: [RTEMS-beatnik, linux-x86_64] # , linux-aarch64]
-        target: [developer, runtime]
+        target: [developer, runtime, proxy]
         include:
+          - os: ubuntu-latest # everyone is on os-latest
+
           - epics-target: RTEMS-beatnik
             epics-host: linux-x86_64
             extension: -rtems-beatnik
             platform: linux/amd64
-            os: ubuntu-latest
+            proxy: "ubuntu:20.04"
 
           - epics-target: linux-x86_64
             epics-host: linux-x86_64
             extension: ""
             platform: linux/amd64
-            os: ubuntu-latest
+            proxy: "none"
 
           # - epics-target: linux-aarch64
           #   epics-host: linux-aarch64
           #   # a temporary name until multi-arch is supported
           #   extension: -native-aarch64
           #   platform: linux/arm64
-          #   os: ubuntu-latest
+
+        exclude:
+          # only native images need a runtime target
+          - epics-target: [RTEMS-beatnik]
+            target: runtime
+          # only cross compiled images need a proxy target
+          - epics-target: [linux-x86_64, linux-aarch64]
+            target: proxy
 
     runs-on: ${{ matrix.os }}
     env:
@@ -68,14 +77,15 @@ jobs:
             TARGET_ARCHITECTURE=${{ matrix.epics-target }}
             EPICS_HOST_ARCH=${{ matrix.epics-host }}
             IMAGE_EXT=${{ matrix.extension }}
+            PROXY=${{ matrix.proxy }}
           tags: ${{ env.TAG }}
           cache-from: type=gha,scope=${{ matrix.epics-target }}
           cache-to: type=gha,mode=max,scope=${{ matrix.epics-target }}
           load: true
 
       - name: Test image
-        # can't test rtems without some hardware to run on
-        if: contains(${{ matrix.epics-target }}, "RTEMS")
+        # can't test non native without some hardware to run on
+        if: contains(${{ matrix.proxy }}, "none")
         run: tests/run-tests.sh
 
       - name: Push image
@@ -89,6 +99,7 @@ jobs:
             TARGET_ARCHITECTURE=${{ matrix.epics-target }}
             EPICS_HOST_ARCH=${{ matrix.epics-host }}
             IMAGE_EXT=${{ matrix.extension }}
+            PROXY=${{ matrix.proxy }}
           tags: ${{ env.TAG }}
           push: true
 
diff --git a/Dockerfile b/Dockerfile
index a3aba72..a53ceee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,14 @@
-##### build stage ##############################################################
+
 
 ARG TARGET_ARCHITECTURE=linux-x86_64
 ARG EPICS_HOST_ARCH=linux-x86_64
 ARG IMAGE_EXT
+ARG PROXY
 
 ARG BASE=7.0.8ec2b1
 ARG REGISTRY=ghcr.io/epics-containers
 
+##### build stage ##############################################################
 FROM  ${REGISTRY}/epics-base${IMAGE_EXT}-developer:${BASE} AS developer
 
 # The devcontainer mounts the project root to /epics/generic-source
@@ -56,14 +58,12 @@ COPY ioc ${SOURCE_FOLDER}/ioc
 RUN cd ${IOC} && ./install.sh && make
 
 ##### runtime preparation stage ################################################
-
 FROM developer AS runtime_prep
 
 # get the products from the build stage and reduce to runtime assets only
 RUN ibek ioc extract-runtime-assets /assets ${SOURCE_FOLDER}/ibek*
 
 ##### runtime stage ############################################################
-
 FROM ${REGISTRY}/epics-base${IMAGE_EXT}-runtime:${BASE} AS runtime
 
 # get runtime assets from the preparation stage
@@ -75,3 +75,9 @@ RUN ibek support apt-install --runtime
 ENV TARGET_ARCHITECTURE ${IMAGE_NAME}
 
 ENTRYPOINT ["/bin/bash", "-c", "${IOC}/start.sh"]
+
+##### proxy stage ##############################################################
+FROM ${PROXY} as proxy
+
+RUN echo 'this will be a proxy pod for the real IOC'
+