diff --git a/README.md b/README.md
index a5c7f7481..6961be02d 100644
--- a/README.md
+++ b/README.md
@@ -73,11 +73,15 @@ docker pull ghcr.io/chipsalliance/t1-blastoise:latest
 ```
 
 Or build the image using nix and load it into docker
+
 ```bash
-nix build -L ".#t1.$config.release.docker-layers.final-image"
-docker load -i ./result/image.tar
+nix build -L ".#t1.$config.release.docker-image" --out-link docker-image.tar.gz
+docker load -i ./docker-image.tar.gz
 ```
 
+> Using nix to build docker-image required KVM feature, so this derivation might not be available
+> for some platform that has no QEMU/KVM support.
+
 ### Nix setup
 We use Nix Flake as our primary build system. If you have not installed nix, install it following the [guide](https://nixos.org/manual/nix/stable/installation/installing-binary.html), and enable flake following the [wiki](https://nixos.wiki/wiki/Flakes#Enable_flakes). Or you can try the [installer](https://github.com/DeterminateSystems/nix-installer) provided by Determinate Systems, which enables flake by default.
 
diff --git a/nix/t1/release/default.nix b/nix/t1/release/default.nix
index b1e20d8df..6dcb70a55 100644
--- a/nix/t1/release/default.nix
+++ b/nix/t1/release/default.nix
@@ -50,7 +50,7 @@ lib.makeScope newScope (scope: rec {
         --add-flags "--emulator-path ${ip.emu-trace}/bin/emulator"
     '';
 
-  docker-layers = scope.callPackage ./docker-layers.nix { };
+  docker-image = scope.callPackage ./docker-image.nix { };
 
   doc = stdenvNoCC.mkDerivation {
     name = "${configName}-typst-release-doc";
diff --git a/nix/t1/release/docker-layers.nix b/nix/t1/release/docker-image.nix
similarity index 59%
rename from nix/t1/release/docker-layers.nix
rename to nix/t1/release/docker-image.nix
index e8c164f90..32dcde754 100644
--- a/nix/t1/release/docker-layers.nix
+++ b/nix/t1/release/docker-image.nix
@@ -1,7 +1,9 @@
 { lib
   # build deps
 , dockerTools
+, buildEnv
 , runCommand
+, runtimeShell
 
   # Runtime deps
 , bashInteractive
@@ -17,24 +19,27 @@
 }:
 
 let
-  # Don't use buildImage which relies on KVM feature
-  self = dockerTools.streamLayeredImage {
+  # dockerTools.buildImage relies on KVM feature, don't run it inside VMs
+  self = dockerTools.buildImage rec {
     name = "chipsalliance/t1-${configName}";
     tag = "latest";
 
-    contents = with dockerTools; [
-      usrBinEnv
-      binSh
+    copyToRoot = buildEnv {
+      name = "${name}.imageroot";
+      paths = with dockerTools; [
+        usrBinEnv
+        binSh
 
-      bashInteractive
-      which
+        bashInteractive
+        which
 
-      emulator-wrapped
-    ]
-    ++ rv32-stdenv.initialPath;
+        emulator-wrapped
+      ] ++ rv32-stdenv.initialPath;
+      pathsToLink = [ "/bin" ];
+    };
 
-    enableFakechroot = true;
-    fakeRootCommands = ''
+    runAsRoot = ''
+      #!${runtimeShell}
       echo "Start finalizing rootfs"
 
       echo "Creating testcase directory"
@@ -46,21 +51,13 @@ let
       done
       chmod u+w -R /workspace/cases
 
-      mkdir /tmp
+      mkdir -p /tmp
     '';
 
     config = {
       # Cmd = [ ];
       WorkingDir = "/workspace";
     };
-
-    passthru = {
-      final-image = runCommand "convert-layer-to-final-image" { } ''
-        mkdir $out
-
-        ${bashInteractive}/bin/bash ${self} > $out/image.tar
-      '';
-    };
   };
 in
 self