diff --git a/build-appdir.sh b/build-appdir.sh
deleted file mode 100644
index 1e8490dfd..000000000
--- a/build-appdir.sh
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/bin/bash
-
-set -e
-set -x
-
-
-#######################################################################
-
-# build AppImageTool AppDir
-APPIMAGETOOL_APPDIR=appdirs/appimagetool.AppDir
-
-rm -rf "$APPIMAGETOOL_APPDIR" || true
-
-# Run make install only for the 'appimagetool.AppImage' component to deploy appimagetools files to
-# the $APPIMAGETOOL_APPDIR
-DESTDIR="$APPIMAGETOOL_APPDIR" cmake -DCOMPONENT=appimagetool -P cmake_install.cmake
-
-mkdir -p "$APPIMAGETOOL_APPDIR"/usr/lib/appimagekit/
-
-# Copy AppDir specific files
-cp ../resources/AppRun "$APPIMAGETOOL_APPDIR"
-cp install_prefix/usr/lib/appimagekit/mksquashfs "$APPIMAGETOOL_APPDIR"/usr/lib/appimagekit/
-# prefer binaries from /deps, if available
-export PATH=/deps/bin:"$PATH"
-cp $(which desktop-file-validate) "$APPIMAGETOOL_APPDIR"/usr/bin/
-cp $(which zsyncmake) "$APPIMAGETOOL_APPDIR"/usr/bin/
-
-cp ../resources/appimagetool.desktop "$APPIMAGETOOL_APPDIR"
-cp ../resources/appimagetool.png "$APPIMAGETOOL_APPDIR"/appimagetool.png
-cp "$APPIMAGETOOL_APPDIR"/appimagetool.png "$APPIMAGETOOL_APPDIR"/.DirIcon
-
-if [ -d /deps/ ]; then
-    # deploy glib
-    mkdir -p "$APPIMAGETOOL_APPDIR"/usr/lib/
-    cp /deps/lib/lib*.so* "$APPIMAGETOOL_APPDIR"/usr/lib/
-    # libffi is a runtime dynamic dependency
-    # see this thread for more information on the topic:
-    # https://mail.gnome.org/archives/gtk-devel-list/2012-July/msg00062.html
-    if [ "$ARCH" == "x86_64" ]; then
-        cp /usr/lib64/libffi.so.5 "$APPIMAGETOOL_APPDIR"/usr/lib/
-    elif [ "$ARCH" == "i686" ]; then
-        cp /usr/lib/libffi.so.5 "$APPIMAGETOOL_APPDIR"/usr/lib/
-    elif [ "$ARCH" == "armhf" ] || [ "$ARCH" == "aarch64" ]; then
-        cp /deps/lib/libffi.so.6 "$APPIMAGETOOL_APPDIR"/usr/lib/
-    else
-        echo "WARNING: unknown architecture, not bundling libffi"
-    fi
-fi
diff --git a/ci/build-appdir.sh b/ci/build-appdir.sh
new file mode 100755
index 000000000..951963d53
--- /dev/null
+++ b/ci/build-appdir.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+
+set -e
+set -x
+set -o functrace
+
+if [[ "$3" == "" ]]; then
+    echo "Usage: bash $0 <repo root> <install-prefix> <appimagetool AppDir>"
+    exit 2
+fi
+
+# using shift makes adding/removing parameters easier
+repo_root="$1"
+shift
+install_prefix="$1"
+shift
+appimagetool_appdir="$1"
+
+if [[ ! -d "$install_prefix" ]]; then
+    echo "Error: could not find install-prefix directory: $install_prefix"
+    exit 3
+fi
+
+if [[ ! -d "$repo_root" ]]; then
+    echo "Error: could not find repo root directory: $repo_root"
+    exit 4
+fi
+
+if [[ -d "$appimagetool_appdir" ]]; then
+    echo "Warning: removing existing appimagetool AppDir: $appimagetool_appdir"
+    rm -rf "$appimagetool_appdir"
+fi
+
+# Run make install only for the appimagetool component to deploy appimagetools files to
+# the $appimagetool_appdir
+DESTDIR="$appimagetool_appdir" cmake -DCOMPONENT=appimagetool -P cmake_install.cmake
+
+mkdir -p "$appimagetool_appdir"/usr/lib/appimagekit/
+
+# Copy AppDir specific files
+cp "$repo_root"/resources/AppRun "$appimagetool_appdir"
+cp "$install_prefix"/usr/lib/appimagekit/mksquashfs "$appimagetool_appdir"/usr/lib/appimagekit/
+
+# prefer binaries from /deps, if available
+export PATH=/deps/bin:"$PATH"
+cp "$(which desktop-file-validate)" "$appimagetool_appdir"/usr/bin/
+cp "$(which zsyncmake)" "$appimagetool_appdir"/usr/bin/
+
+cp "$repo_root"/resources/appimagetool.desktop "$appimagetool_appdir"
+cp "$repo_root"/resources/appimagetool.png "$appimagetool_appdir"/appimagetool.png
+cp "$appimagetool_appdir"/appimagetool.png "$appimagetool_appdir"/.DirIcon
+
+if [ -d /deps/ ]; then
+    # deploy GLib
+    mkdir -p "$appimagetool_appdir"/usr/lib/
+    cp /deps/lib/lib*.so* "$appimagetool_appdir"/usr/lib/
+
+    # libffi is a runtime dynamic dependency
+    # see this thread for more information on the topic:
+    # https://mail.gnome.org/archives/gtk-devel-list/2012-July/msg00062.html
+    if [ "$ARCH" == "x86_64" ]; then
+        cp "$(ldconfig -p | grep libffi.so.6 | grep x86-64 | cut -d'>' -f2 | tr -d ' ')" "$appimagetool_appdir"/usr/lib/
+    elif [ "$ARCH" == "i686" ]; then
+        cp "$(ldconfig -p | grep libffi.so.6 | grep i386 | cut -d'>' -f2 | tr -d ' ')" "$appimagetool_appdir"/usr/lib/
+    elif [ "$ARCH" == "armhf" ]; then
+        cp "$(ldconfig -p | grep libffi.so.6 | grep arm | grep hf | cut -d'>' -f2 | tr -d ' ')" "$appimagetool_appdir"/usr/lib/
+    elif [ "$ARCH" == "aarch64" ]; then
+        cp "$(ldconfig -p | grep libffi.so.6 | grep aarch64 | cut -d'>' -f2 | tr -d ' ')" "$appimagetool_appdir"/usr/lib/
+    else
+        echo "WARNING: unknown architecture, not bundling libffi"
+    fi
+fi
diff --git a/ci/build-appimage.sh b/ci/build-appimage.sh
deleted file mode 100755
index e8be2a257..000000000
--- a/ci/build-appimage.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#! /bin/bash
-
-set -e
-
-cd /AppImageKit/build
-
-cd out/
-
-if [ "$TRAVIS_PULL_REQUEST" == "false" ] || [ "$TRAVIS_PULL_REQUEST" == "" ]; then
-    # Sign only when NOT on a pull request
-    ./appimagetool.AppDir/AppRun ./appimagetool.AppDir/ -s -v \
-        -u "gh-releases-zsync|AppImage|AppImageKit|continuous|appimagetool-$ARCH.AppImage.zsync" \
-        appimagetool-"$ARCH".AppImage
-else
-  # Do not attempt to sign (it would fail ayway)
-    ./appimagetool.AppDir/AppRun ./appimagetool.AppDir/ -v \
-        -u "gh-releases-zsync|AppImage|AppImageKit|continuous|appimagetool-$ARCH.AppImage.zsync" \
-        appimagetool-"$ARCH".AppImage
-fi
diff --git a/ci/build-binaries-and-appimage.sh b/ci/build-binaries-and-appimage.sh
new file mode 100755
index 000000000..47565da2a
--- /dev/null
+++ b/ci/build-binaries-and-appimage.sh
@@ -0,0 +1,97 @@
+#! /bin/bash
+
+set -e
+set -x
+set -o functrace
+
+# make sure the prebuilt libraries in the container will be found
+# (in case we're building in an AppImageBuild container)
+export LD_LIBRARY_PATH=/deps/lib:"$LD_LIBRARY_PATH"
+export PKG_CONFIG_PATH=/deps/lib/pkgconfig/
+export PATH=/deps/bin:"$PATH"
+
+# note: signing is not working at the moment
+# see ci-build.sh for more information
+echo "$KEY" | md5sum
+
+# we always build in a temporary directory
+# use RAM disk if possible
+if [ -d /dev/shm ] && mount | grep /dev/shm | grep -v -q noexec; then
+    TEMP_BASE=/dev/shm
+elif [ -d /docker-ramdisk ]; then
+    TEMP_BASE=/docker-ramdisk
+else
+    TEMP_BASE=/tmp
+fi
+
+BUILD_DIR="$(mktemp -d -p "$TEMP_BASE" AppImageKit-build-XXXXXX)"
+
+cleanup () {
+    if [ -d "$BUILD_DIR" ]; then
+        rm -rf "$BUILD_DIR"
+    fi
+}
+
+trap cleanup EXIT
+
+REPO_ROOT="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")"/..)"
+OLD_CWD="$(readlink -f .)"
+
+pushd "$BUILD_DIR"
+
+# configure build and generate build files
+cmake "$REPO_ROOT" \
+    -DCMAKE_INSTALL_PREFIX=/usr \
+    -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+    -DBUILD_TESTING=ON \
+    -DAPPIMAGEKIT_PACKAGE_DEBS=ON
+
+# run build
+if [[ "$CI" != "" ]]; then
+    nproc="$(nproc)"
+else
+    nproc="$(nproc --ignore=1)"
+fi
+
+make -j"$nproc"
+
+# install so-far-built binaries into some prefix
+# this way, we can test them, use them to build the AppDir later, copy stuff from there into said AppDir, ...
+install_prefix="install-prefix"
+make install DESTDIR="$install_prefix"
+
+# print first few bytes in runtime
+# allows checking whether the magic bytes are in place
+xxd src/runtime | head -n1
+
+# strip everything *but* runtime
+find "$install_prefix"/usr/bin/ -not -iname runtime -print -exec "$STRIP" "{}" \; 2>/dev/null
+
+# more debugging
+ls -lh "$install_prefix"/usr/bin
+for FILE in "$install_prefix"/usr/bin/*; do
+  echo "$FILE"
+  ldd "$FILE" || true
+done
+
+# continue building AppDir
+appdir="appimagetool.AppDir"
+bash "$REPO_ROOT"/ci/build-appdir.sh "$REPO_ROOT" "$install_prefix" "$appdir"
+
+# list result
+ls -lh
+find "$install_prefix"
+
+# test built appimagetool
+"$REPO_ROOT"/ci/test-appimagetool.sh "$REPO_ROOT" "$install_prefix"/usr/bin/appimagetool
+
+# seems to work -- let's build an AppImage
+# we start by putting the rest of the files into the AppDir
+
+"$appdir"/AppRun ./appimagetool.AppDir/ -v \
+    -u "gh-releases-zsync|AppImage|AppImageKit|continuous|appimagetool-$ARCH.AppImage.zsync" \
+    appimagetool-"$ARCH".AppImage
+
+mv appimagetool-"$ARCH".AppImage "$OLD_CWD"
+mv "$install_prefix"/usr/lib/appimagekit/runtime "$OLD_CWD"
+mv "$install_prefix"/usr/bin/* "$OLD_CWD"
diff --git a/ci/build-binaries.sh b/ci/build-binaries.sh
deleted file mode 100755
index 3292291f5..000000000
--- a/ci/build-binaries.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#! /bin/bash
-
-set -e
-set -x
-
-cd /AppImageKit
-
-./build.sh "$@"
-
-# make sure the prebuilt libraries in the container will be found
-export LD_LIBRARY_PATH=/deps/lib:"$LD_LIBRARY_PATH"
-
-./test-appimagetool.sh build/install_prefix/usr/bin/appimagetool
diff --git a/ci/build-in-docker.sh b/ci/build-in-docker.sh
new file mode 100755
index 000000000..17f009c38
--- /dev/null
+++ b/ci/build-in-docker.sh
@@ -0,0 +1,48 @@
+#! /bin/bash
+
+if [[ "$DIST" == "" ]] || [[ "$ARCH" == "" ]]; then
+    echo "Usage: env ARCH=... DIST=... bash $0"
+    exit 1
+fi
+
+set -x
+set -e
+
+cd "$(readlink -f "$(dirname "$0")")"
+
+# sets variables $image, $dockerfile
+source build-docker-image.sh
+
+# figure out which build script to use
+if [[ "$BUILD_LITE" == "" ]]; then
+    build_script=build.sh
+else
+    build_script=build-lite.sh
+fi
+
+DOCKER_OPTS=()
+# fix for https://stackoverflow.com/questions/51195528/rcc-error-in-resource-qrc-cannot-find-file-png
+if [ "$CI" != "" ]; then
+    DOCKER_OPTS+=("--security-opt" "seccomp:unconfined")
+fi
+
+# only if there's more than 3G of free space in RAM, we can build in a RAM disk
+if [[ "$GITHUB_ACTIONS" != "" ]]; then
+    echo "Building on GitHub actions, which does not support --tmpfs flag -> building on regular disk"
+elif [[ "$(free -m  | grep "Mem:" | awk '{print $4}')" -gt 3072 ]]; then
+    echo "Host system has enough free memory -> building in RAM disk"
+    DOCKER_OPTS+=("--tmpfs /docker-ramdisk:exec,mode=777")
+else
+    echo "Host system does not have enough free memory -> building on regular disk"
+fi
+
+# run the build with the current user to
+#   a) make sure root is not required for builds
+#   b) allow the build scripts to "mv" the binaries into the /out directory
+uid="$(id -u)"
+# run build
+docker run -e DIST -e ARCH -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ID --rm -i --user "$uid" \
+     "${DOCKER_OPTS[@]}" -v "$(readlink -f ..):/ws" \
+     "$image" \
+     bash -xc "export CI=1 && cd /ws && source ci/$build_script"
+
diff --git a/ci/ci-build.sh b/ci/ci-build.sh
index e558c41d5..acc7282b4 100755
--- a/ci/ci-build.sh
+++ b/ci/ci-build.sh
@@ -3,81 +3,121 @@
 set -e
 set -x
 
-if [ "$CI" == "" ]; then
-    echo "Not running on CI system, aborting to prevent damage from system"
+if [[ "$ARCH" == "" ]]; then
+    echo "Usage: env ARCH=... bash $0"
     exit 2
 fi
 
 case "$ARCH" in
     "x86_64")
         export ARCH="x86_64"
+        docker_dist=centos7
         ;;
     "i386"|"i686")
         export ARCH="i686"
-        # sleep so as not to overwrite during uploading (FIXME)
-        sleep 60
+        docker_dist=centos7
+        ;;
+    armhf|aarch64)
+        docker_dist=xenial
+        ;;
+    *)
+        echo "Unknown architecture: $ARCH"
+        exit 3
         ;;
 esac
 
+
+#### NOTE ####
+# Signing is currently broken, as the secret to decrypt the key is not available at the moment.
+# Even worse, putting key material in a third-party execution environment is not a good idea
+# to begin with.
+# The signing doesn't add anything security wise anyway, so it doesn't really matter if it works
+# at the moment or not.
+#### END NOTE ####
+
 # clean up and download data from GitHub
-rm -rf data.tar.g* .gnu* || true
-wget https://github.com/AppImage/AppImageKit/files/584665/data.zip -O data.tar.gz.gpg
-( set +x ; echo $KEY | gpg2 --batch --passphrase-fd 0 --no-tty --skip-verify --output data.tar.gz --decrypt data.tar.gz.gpg ) || true
-( tar xf data.tar.gz ; sudo chown -R $USER .gnu* ; rm -rf $HOME/.gnu* ; mv .gnu* $HOME/ ) || true
+#rm -rf data.tar.g* .gnu* || true
+#wget https://github.com/AppImage/AppImageKit/files/584665/data.zip -O data.tar.gz.gpg
+#( set +x ; echo $KEY | gpg2 --batch --passphrase-fd 0 --no-tty --skip-verify --output data.tar.gz --decrypt data.tar.gz.gpg ) || true
+#( tar xf data.tar.gz ; sudo chown -R $USER .gnu* ; rm -rf $HOME/.gnu* ; mv .gnu* $HOME/ ) || true
 
-# prepare output directory
-mkdir -p ./out/
 
-# build AppImageKit
-docker run --rm \
-    --device /dev/fuse:mrw \
-    -e ARCH \
-    -i \
-    -v "${PWD}":/AppImageKit \
-    -v "${PWD}"/travis/:/travis \
-    "$DOCKER_IMAGE" \
-    /bin/bash -x "/travis/build-binaries.sh" --run-tests
-
-# inspect AppDirs
-find build/out/appimagetool.AppDir/
-
-# build AppImage
-docker run --rm \
-    --cap-add SYS_ADMIN \
-    --device /dev/fuse:mrw \
-    -e ARCH \
-    -i \
-    -v "${PWD}":/AppImageKit \
-    -v "${PWD}"/travis/:/travis \
-    -v $HOME/.gnupg:/root/.gnupg \
-    "$DOCKER_IMAGE" \
-    /bin/bash -x "/travis/build-appimage.sh"
+# make sure we're in the repository root directory
+this_dir="$(readlink -f "$(dirname "$0")")"
+repo_root="$this_dir"/..
 
-cd build/
+# docker image name
+docker_image=quay.io/appimage/appimagebuild:"$docker_dist"-"$ARCH"
+# make sure it's up to date
+docker pull "$docker_image"
 
-# test AppImages
-[ "$ARCH" == "i686" ] && sudo apt-get update && sudo apt-get install -y gcc-multilib lib32z1 libfuse2 libfuse2:i386 libglib2.0-0:i386 libcairo2:i386
-[ "$ARCH" != "armhf" ] && [ "$ARCH" != "aarch64" ] && bash -x ../travis/test-appimage.sh
+# prepare output directory
+mkdir -p out/
+
+# we run all builds with non-privileged user accounts to make sure the build doesn't depend on such features
+uid="$(id -u)"
+
+# note: we cannot just use '-e ARCH', as this wouldn't overwrite the value set via ENV ARCH=... in the image
+common_docker_opts=(
+    -e TERM="$TERM"
+    -e ARCH="$ARCH"
+    -i
+    -v "$repo_root":/ws
+    -v "$(readlink -f out/)":/out
+)
+
+# make ctrl-c work
+if [[ "$TERM" != "" ]]; then
+    common_docker_opts+=("-t")
+fi
 
-# install more tools
-# (vim-common contains xxd)
-sudo apt-get install vim-common
+# build AppImageKit and appimagetool-"$ARCH".AppImage
+# TODO: make gnupg home available, e.g., through "-v" "$HOME"/.gnupg:/root/.gnupg
+# TODO: this ^ won't work since we don't build as root any more
+# note: we enforce using the same UID in the container as outside, so that the created files are owned by the caller
+docker run --rm \
+    --user "$uid" \
+    "${common_docker_opts[@]}" \
+    "-v" "$HOME"/.gnupg:/root/.gnupg \
+    "$docker_image" \
+    /bin/bash -xc "cd /out && /ws/ci/build-binaries-and-appimage.sh --run-tests"
+
+# test appimagetool-"$ARCH".AppImage
+# note: if we're in a CI system, we allow the use of FUSE in the container, to make sure that this functionality works as intended
+# outside CI environments, we use APPIMAGE_EXTRACT_AND_RUN instead, which is safer, but gives less meaningful results
+docker_test_opts=("${common_docker_opts[@]}")
+
+if [[ "$CI" != "" ]]; then
+    echo "Warning: assuming this is running in a CI environment, allowing the use of FUSE in the container"
+    docker_test_opts+=(
+        "--device" "/dev/fuse:mrw"
+        "--cap-add" "SYS_ADMIN"
+    )
+else
+    echo "Note: this is not a CI environment, using APPIMAGE_EXTRACT_AND_RUN and patching out magic bytes"
+    docker_test_opts+=(
+        "-e" "APPIMAGE_EXTRACT_AND_RUN=1"
+        "-e" "PATCH_OUT_MAGIC_BYTES=1"
+    )
+fi
 
-# fix permissions
-sudo chown -R runner.runner .
+# to make fuse happy, we need to use a "real" user
+# as we don't want to use root, we use the user "build" we created in AppImageBuild
+docker run --rm \
+    --user build \
+    "${docker_test_opts[@]}" \
+    "$docker_image" \
+    /bin/bash -xc "cd /out && bash /ws/ci/test-appimage.sh ./appimagetool-\"$ARCH\".AppImage"
 
 # remove binaries from output directory
 ls -al out/
-rm -r out/{appimagetool,mksquashfs,*.AppDir}
-rm -r out/{validate,digest} || true
+rm out/appimagetool
+rm out/{validate,digest}
 
-# inspect runtime
-xxd out/runtime | head -n 1 | grep "4149 0200"
+# make sure the runtime contains the magic bytes
+hexdump -Cv out/runtime | head -n 1 | grep "41 49 02 00"
 # fix filename for upload
 mv out/runtime out/runtime-"$ARCH"
 
-# remove unused files
-sudo rm -rf out/*.AppDir out/*.AppImage.digest
-
 # fix filename for upload
-sudo mv out/AppRun out/AppRun-"$ARCH"
+mv out/AppRun out/AppRun-"$ARCH"
diff --git a/ci/test-appimage.sh b/ci/test-appimage.sh
index 9cc0a9f23..62f6175c5 100755
--- a/ci/test-appimage.sh
+++ b/ci/test-appimage.sh
@@ -5,21 +5,42 @@ set -x
 set +e
 
 TIMEOUT=3
-ARCH=${ARCH:-$(uname -m)}
+ARCH="${ARCH:-"$(uname -m)"}"
 
 error() {
     echo "Error: command failed" >&2
     exit 1
 }
 
+if [[ "$1" == "" ]] || [[ ! -x "$1" ]]; then
+    echo "Usage: env [PATCH_OUT_MAGIC_BYTES=1] bash $0 <appimagetool.AppImage>"
+    exit 2
+fi
+
+appimagetool="$1"
+
+if [[ "$PATCH_OUT_MAGIC_BYTES" != "" ]]; then
+    tmpdir="$(mktemp -d /tmp/appimage-test-XXXXX)"
+    cleanup() {
+        [[ -d "$tmpdir" ]] && rm -r "$tmpdir"
+    }
+    trap cleanup EXIT
+
+    echo "Copying appimagetool and patching out magic bytes"
+    cp "$appimagetool" "$tmpdir/"
+    ls -al "$tmpdir"
+    appimagetool="$tmpdir"/"$(basename "$appimagetool")"
+    dd if=/dev/zero of="$appimagetool" bs=1 count=3 seek=8 conv=notrunc
+fi
+
 # first of all, try to run appimagetool
-out/appimagetool-"$ARCH".AppImage && error  # should fail due to missing parameter
-out/appimagetool-"$ARCH".AppImage -h || error  # should not fail
+"$appimagetool" && error  # should fail due to missing parameter
+"$appimagetool" -h || error  # should not fail
 
 # print version and update information
-out/appimagetool-"$ARCH".AppImage --version || error  # should not fail
-out/appimagetool-"$ARCH".AppImage --appimage-version || error  # should not fail
-out/appimagetool-"$ARCH".AppImage --appimage-updateinformation || error  # should not fail
+"$appimagetool" --version || error  # should not fail
+"$appimagetool" --appimage-version || error  # should not fail
+"$appimagetool" --appimage-updateinformation || error  # should not fail
 
 echo "" >&2
 echo "Tests successful!" >&2
diff --git a/test-appimagetool.sh b/ci/test-appimagetool.sh
similarity index 68%
rename from test-appimagetool.sh
rename to ci/test-appimagetool.sh
index 8e656232e..3ce574dad 100755
--- a/test-appimagetool.sh
+++ b/ci/test-appimagetool.sh
@@ -4,22 +4,52 @@ set -e
 set -E
 set -o functrace
 
-# this script attempts to package appimagetool as an AppImage with... surprise, appimagetool
+if [[ "$2" == "" ]]; then
+    echo "Usage: bash $0 <repo root> <appimagetool>"
+    exit 2
+fi
 
-tempdir=$(mktemp -d /tmp/appimage-test.XXXXXXXX)
-thisdir=$(dirname $(readlink -f "$0"))
+# using shift makes adding/removing parameters easier
+repo_root="$(readlink -f "$1")"
+shift
+appimagetool="$(readlink -f "$1")"
 
-appimagetool=$(readlink -f "$1")
+if [[ ! -x "$appimagetool" ]]; then
+    echo "Error: appimagetool $appimagetool is not an executable"
+    exit 3
+fi
 
-# make sure to use the built mksquashfs
-export PATH=$(dirname "$appimagetool"):"$PATH"
+# this script attempts to package appimagetool as an AppImage with... surprise, appimagetool
 
-if [ ! -f "$appimagetool" ] || [ ! -x "$appimagetool" ]; then
-    echo "Usage: $0 <path to appimagetool>"
-    exit 1
+# we always build in a temporary directory
+# use RAM disk if possible
+if [ -d /dev/shm ] && mount | grep /dev/shm | grep -v -q noexec; then
+    TEMP_BASE=/dev/shm
+elif [ -d /docker-ramdisk ]; then
+    TEMP_BASE=/docker-ramdisk
+else
+    TEMP_BASE=/tmp
 fi
 
-if [ "$TRAVIS" == true ]; then
+BUILD_DIR="$(mktemp -d -p "$TEMP_BASE" appimagetool-test-XXXXXX)"
+
+cleanup () {
+    if [ -d "$BUILD_DIR" ]; then
+        rm -rf "$BUILD_DIR"
+    fi
+}
+
+trap cleanup EXIT
+
+REPO_ROOT="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")"/..)"
+OLD_CWD="$(readlink -f .)"
+
+pushd "$BUILD_DIR"
+
+# make sure to use the built mksquashfs
+export PATH="$(dirname "$appimagetool")":"$PATH"
+
+if [ "$CI" == true ]; then
   # TODO: find way to get colored log on Travis
   log() { echo -e "\n$*\n"; }
 else
@@ -31,28 +61,24 @@ trap '[[ $FUNCNAME = exithook ]] || { last_lineno=$real_lineno; real_lineno=$LIN
 
 exithook() {
     local exitcode="$1"
-    local lineno=${last_lineno:-$2}
+    local lineno="${last_lineno:-$2}"
 
-    if [ $exitcode -ne 0 ]; then
+    if [ "$exitcode" -ne 0 ]; then
         echo "$(tput setaf 1)$(tput bold)Test run failed: error in line $lineno$(tput sgr0)"
     else
         log "Tests succeeded!"
     fi
 
-    rm -r "$tempdir";
-
-    exit $exitcode
+    exit "$exitcode"
 }
 
 trap 'exithook $? $LINENO ${BASH_LINENO[@]}' EXIT
 
 # real script begins here
-cd "$tempdir"
-
 log "create a sample AppDir"
 mkdir -p appimagetool.AppDir/usr/share/metainfo/
-cp "$thisdir"/resources/{appimagetool.*,AppRun} appimagetool.AppDir/
-#cp "$thisdir"/resources/usr/share/metainfo/appimagetool.appdata.xml appimagetool.AppDir/usr/share/metainfo/
+cp "$repo_root"/resources/{appimagetool.*,AppRun} appimagetool.AppDir/
+#cp "$repo_root"/resources/usr/share/metainfo/appimagetool.appdata.xml appimagetool.AppDir/usr/share/metainfo/
 cp "$appimagetool" appimagetool.AppDir/
 mkdir -p appimagetool.AppDir/usr/share/applications
 cp appimagetool.AppDir/appimagetool.desktop appimagetool.AppDir/usr/share/applications