diff --git a/binhost.sh b/binhost.sh
index 1183e3e..95f2c53 100755
--- a/binhost.sh
+++ b/binhost.sh
@@ -1,8 +1,9 @@
 #!/bin/bash
 set -euo pipefail
 
+WORK_DIR="$(cd "$(dirname "$0")" && pwd)"
+
 REPO_URL="git@git.ayau.me:mira/gentoo-pill.git"
-WORK_DIR="$(pwd)"
 REPO="${WORK_DIR}/repo"
 CTX="${WORK_DIR}/ctx"
 
@@ -10,17 +11,42 @@ IMAGE="docker.io/gentoo/stage3:amd64-desktop-openrc"
 CONTAINER_NAME="gentoo_builder"
 PROFILE="default/linux/amd64/23.0/desktop"
 LOG_FILE="/var/log/gentoo_build.log" # inside container
-HOST_KEY_PATH="$(pwd)/secrets/signing.key"
+HOST_KEY_PATH="${WORK_DIR}/secrets/signing.key"
+
+if [[ ! -f "$HOST_KEY_PATH" ]]; then
+    echo "Error: no key at $HOST_KEY_PATH"
+    exit 1
+fi
 
 if [[ ! -d "$REPO/.git" ]]; then
+    echo "Cloning repo..."
     git clone "$REPO_URL" "$REPO"
 else
-    git -C "$REPO" pull --rebase
+    echo "Updating repo..."
+    # juts reset here
+    git -C "$REPO" fetch origin
+    git -C "$REPO" reset --hard origin/master
 fi
 
 echo "Aggregating config..."
 rm -rf "$CTX" && mkdir -p "$CTX"/var/lib/portage
 
+inject() {
+    local src=$1 prefix=$2 dest_dir=$3
+    [[ ! -e "$src" ]] && return
+
+    if [[ -d "$src" ]]; then
+        shopt -s nullglob
+        for f in "$src"/*; do
+            [[ -f "$f" ]] && cp "$f" "$dest_dir/${prefix}-$(basename "$f")"
+        done
+        shopt -u nullglob
+    else
+        cp "$src" "$dest_dir/${prefix}-$(basename "$src")"
+    fi
+}
+
+
 # config types to merge
 CONFIGS=(package.use package.accept_keywords package.license package.mask package.unmask package.env repos.conf)
 
@@ -28,25 +54,12 @@ for type in "${CONFIGS[@]}"; do
     dest="$CTX/etc/portage/$type"
     mkdir -p "$dest"
 
-    inject() {
-        local src=$1 prefix=$2
-        [[ ! -e "$src" ]] && return
-
-        if [[ -d "$src" ]]; then
-            for f in "$src"/*; do
-                [[ -f "$f" ]] && cp "$f" "$dest/${prefix}-$(basename "$f")"
-            done
-        else
-            cp "$src" "$dest/${prefix}-$(basename "$src")"
-        fi
-    }
-
-    inject "$REPO/common/$type" "00-common"
+    inject "$REPO/common/$type" "00-common" "$dest"
 
     for host_dir in "$REPO/hosts"/*; do
         [[ -d "$host_dir" ]] || continue
         hostname=$(basename "$host_dir")
-        inject "$host_dir/$type" "50-${hostname}"
+        inject "$host_dir/$type" "50-${hostname}" "$dest"
     done
 done
 
@@ -61,6 +74,10 @@ cp "$REPO/binhost/make.conf" "$CTX/etc/portage/make.conf"
 init_container() {
     echo "Creating new builder container..."
 
+    podman volume create portage_db
+    podman volume create distfiles
+    podman volume create binpkgs
+
     podman run -d \
         --name "$CONTAINER_NAME" \
         --cap-add=SYS_PTRACE \
@@ -77,7 +94,11 @@ init_container() {
         mkdir -p /root/.gnupg
         chmod 700 /root/.gnupg
         gpg --batch --import /tmp/signing.key
-        emerge-webrsync -q
+
+        if [[ ! -d /var/db/repos/gentoo/profiles ]]; then
+            emerge-webrsync -q
+        fi
+
         emerge -1vn --usepkg --buildpkg dev-vcs/git app-eselect/eselect-repository
         eselect profile set '$PROFILE'
     "
@@ -86,7 +107,9 @@ init_container() {
 if ! podman container exists "$CONTAINER_NAME"; then
     init_container
 else
-    if ! podman container inspect -f '{{.State.Running}}' "$CONTAINER_NAME" >/dev/null 2>&1; then
+    if ! podman container inspect -f '{{.State.Running}}' "$CONTAINER_NAME" | grep -q "true"; then
+        echo "Container running"
+    else
         echo "Starting existing container..."
         podman start "$CONTAINER_NAME"
     fi
@@ -98,28 +121,33 @@ podman cp "$CTX/var/lib/portage/world" "$CONTAINER_NAME":/var/lib/portage/world
 
 echo "Starting Builder..."
 
-cat <<EOF | podman exec -i "$CONTAINER_NAME" sh -c "cat > /usr/local/bin/run_job.sh"
+cat <<'EOF' | podman exec -i "$CONTAINER_NAME" sh -c "cat > /usr/local/bin/run_job.sh"
 #!/bin/bash
 set -e
 source /etc/profile
 
 SYNC_MARKER="/var/db/repos/gentoo/.last_sync_marker"
 
-chown -R portage:portage /etc/portage /var/lib/portage/world
+if pgrep -x emerge >/dev/null; then
+    echo "Emerge is already running?"
+    exit 1
+fi
+
+chown root:root /var/lib/portage/world
 
 echo "Syncing..."
 # if we're missing the tree, sync snapshot
 if [[ ! -d /var/db/repos/gentoo/profiles ]]; then
-    echo "Portage tree missing. Performing initial webrsync..."
+    echo "Tree missing, running webrsync..."
     emerge-webrsync -q
 fi
 
-if [[ -f "\$SYNC_MARKER" ]] && [[ -n "\$(find "\$SYNC_MARKER" -mtime -1 2>/dev/null)" ]]; then
-    echo "Skipping sync: Repo was synced within the last 24h"
+elif [[ -f "$SYNC_MARKER" ]] && [[ -n "$(find "$SYNC_MARKER" -mtime -1 2>/dev/null)" ]]; then
+    echo "Skipping sync: Repo synced <24h ago"
 else
-    echo "Sync timer expired (or marker missing), updating repos..."
-    emaint -a sync
-    touch "\$SYNC_MARKER"
+    echo "Sync timer expired (or marker missing)..."
+    emaint sync -a
+    touch "$SYNC_MARKER"
 fi
 
 echo "Building world.."
@@ -140,6 +168,5 @@ echo "Triggering build in background..."
 podman exec -d "$CONTAINER_NAME" bash -c "chmod +x /usr/local/bin/run_job.sh && /usr/local/bin/run_job.sh > $LOG_FILE 2>&1"
 
 echo "Build is running in the background."
-echo "To view progress, run:"
-echo "  podman exec -it $CONTAINER_NAME tail -f $LOG_FILE"
+echo "To view progress: podman exec -it $CONTAINER_NAME tail -f $LOG_FILE"