diff --git a/Makefile b/Makefile
index fd67ec2b3..d2059afe9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+.DEFAULT_GOAL := help
+
 # Root directory of the project (absolute path).
 ROOTDIR=$(dir $(abspath $(lastword $(MAKEFILE_LIST))))
 
@@ -13,6 +15,9 @@ PACKAGES=$(shell go list -tags "${BUILDTAGS}" ./... | grep -v /vendor/)
 INTEGRATION_PACKAGE=${PKG}
 COVERAGE_PACKAGES=$(filter-out ${PKG}/registry/storage/driver/%,${PACKAGES})
 
+IMAGE_REPO ?= distribution/distribution
+IMAGE_TAG ?= latest
+IMAGE_NAME ?= $(IMAGE_REPO):$(IMAGE_TAG)
 
 # Project binaries.
 COMMANDS=registry digest registry-api-descriptor-template
@@ -38,16 +43,49 @@ BINARIES=$(addprefix bin/,$(COMMANDS))
 TESTFLAGS ?= -v $(TESTFLAGS_RACE)
 TESTFLAGS_PARALLEL ?= 8
 
-.PHONY: all build binaries clean test test-race test-full integration coverage validate lint validate-git validate-vendor vendor mod-outdated
+.PHONY: all build binaries clean test test-race test-full integration coverage validate lint validate-git validate-vendor vendor mod-outdated image
 .DEFAULT: all
 
-all: binaries
+.PHONY: FORCE
+FORCE:
+
+##@ Build
 
 # This only needs to be generated by hand when cutting full releases.
 version/version.go:
 	@echo "$(WHALE) $@"
 	./version/version.sh > $@
 
+bin/%: cmd/% FORCE ## build individual binary
+	@echo "$(WHALE) $@${BINARY_SUFFIX}"
+	@go build -buildmode=pie ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} --ldflags '-extldflags "-Wl,-z,now" -s' ${GO_TAGS}  ./$<
+
+binaries: $(BINARIES) ## build binaries
+	@echo "$(WHALE) $@"
+
+build: ## build go packages
+	@echo "$(WHALE) $@"
+	@go build -buildmode=pie ${GO_GCFLAGS} ${GO_BUILD_FLAGS} ${GO_LDFLAGS} --ldflags '-extldflags "-Wl,-z,now" -s' ${GO_TAGS} $(PACKAGES)
+
+image: ## build docker image IMAGE_NAME=<name>
+	docker buildx bake --set "*.tags=${IMAGE_NAME}" image-local
+
+clean: ## clean up binaries
+	@echo "$(WHALE) $@"
+	@rm -f $(BINARIES)
+
+vendor: ## update vendor
+	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildx-output.XXXXXXXXXX))
+	docker buildx bake --set "*.output=$($@_TMP_OUT)" update-vendor
+	rm -rf ./vendor
+	cp -R "$($@_TMP_OUT)"/out/* .
+	rm -rf $($@_TMP_OUT)/*
+
+mod-outdated: ## check outdated dependencies
+	docker buildx bake $@
+
+##@ Test
+
 test: ## run tests, except integration test with test.short
 	@echo "$(WHALE) $@"
 	@go test ${GO_TAGS} -test.short ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
@@ -79,42 +117,23 @@ coverage: ## generate coverprofiles from the unit tests
 		fi; \
 	done )
 
-FORCE:
-
-# Build a binary from a cmd.
-bin/%: cmd/% FORCE
-	@echo "$(WHALE) $@${BINARY_SUFFIX}"
-	@go build -buildmode=pie ${GO_GCFLAGS} ${GO_BUILD_FLAGS} -o $@${BINARY_SUFFIX} ${GO_LDFLAGS} --ldflags '-extldflags "-Wl,-z,now" -s' ${GO_TAGS}  ./$<
-
-binaries: $(BINARIES) ## build binaries
-	@echo "$(WHALE) $@"
-
-build:
-	@echo "$(WHALE) $@"
-	@go build -buildmode=pie ${GO_GCFLAGS} ${GO_BUILD_FLAGS} ${GO_LDFLAGS} --ldflags '-extldflags "-Wl,-z,now" -s' ${GO_TAGS} $(PACKAGES)
-
-clean: ## clean up binaries
-	@echo "$(WHALE) $@"
-	@rm -f $(BINARIES)
-
-validate: ## run all validators
-	docker buildx bake $@
+##@ Validate
 
 lint: ## run all linters
 	docker buildx bake $@
 
+validate: ## run all validators
+	docker buildx bake $@
+
 validate-git: ## validate git
 	docker buildx bake $@
 
 validate-vendor: ## validate vendor
 	docker buildx bake $@
 
-vendor: ## update vendor
-	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildx-output.XXXXXXXXXX))
-	docker buildx bake --set "*.output=$($@_TMP_OUT)" update-vendor
-	rm -rf ./vendor
-	cp -R "$($@_TMP_OUT)"/out/* .
-	rm -rf $($@_TMP_OUT)/*
-
-mod-outdated: ## check outdated dependencies
-	docker buildx bake $@
+.PHONY: help
+help:
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m\033[0m\n"} /^[a-zA-Z_\/%-]+:.*?##/ { printf "  \033[36m%-27s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
+	@echo ""
+	@echo "Go binaries:   $(BINARIES)"
+	@echo "Docker image: $(IMAGE_NAME)"