diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index a5b3df8f..9a5b4dec 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -18,6 +18,7 @@ jobs:
       fail-fast: false
       matrix:
         target:
+          - lint
           - validate-vendor
     steps:
       -
diff --git a/Makefile b/Makefile
index d30459a2..2f58f44f 100644
--- a/Makefile
+++ b/Makefile
@@ -38,7 +38,7 @@ BINARIES=$(addprefix bin/,$(COMMANDS))
 TESTFLAGS ?= -v $(TESTFLAGS_RACE)
 TESTFLAGS_PARALLEL ?= 8
 
-.PHONY: all build binaries check clean test test-race test-full integration coverage validate-vendor vendor mod-outdated
+.PHONY: all build binaries clean test test-race test-full integration coverage validate lint validate-vendor vendor mod-outdated
 .DEFAULT: all
 
 all: binaries
@@ -48,10 +48,6 @@ version/version.go:
 	@echo "$(WHALE) $@"
 	./version/version.sh > $@
 
-check: ## run all linters (TODO: enable "unused", "varcheck", "ineffassign", "unconvert", "staticheck", "goimports", "structcheck")
-	@echo "$(WHALE) $@"
-	@golangci-lint run
-
 test: ## run tests, except integration test with test.short
 	@echo "$(WHALE) $@"
 	@go test ${GO_TAGS} -test.short ${TESTFLAGS} $(filter-out ${INTEGRATION_PACKAGE},${PACKAGES})
@@ -101,8 +97,14 @@ clean: ## clean up binaries
 	@echo "$(WHALE) $@"
 	@rm -f $(BINARIES)
 
+validate: ## run all validators
+	docker buildx bake $@
+
+lint: ## run all linters
+	docker buildx bake $@
+
 validate-vendor: ## validate vendor
-	docker buildx bake validate-vendor
+	docker buildx bake $@
 
 vendor: ## update vendor
 	$(eval $@_TMP_OUT := $(shell mktemp -d -t buildx-output.XXXXXXXXXX))
@@ -112,4 +114,4 @@ vendor: ## update vendor
 	rm -rf $($@_TMP_OUT)/*
 
 mod-outdated: ## check outdated dependencies
-	docker buildx bake mod-outdated
+	docker buildx bake $@
diff --git a/docker-bake.hcl b/docker-bake.hcl
index a6fb5622..4b776fcc 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -3,7 +3,12 @@ group "default" {
 }
 
 group "validate" {
-  targets = ["validate-vendor"]
+  targets = ["lint", "validate-vendor"]
+}
+
+target "lint" {
+  dockerfile = "./dockerfiles/lint.Dockerfile"
+  output = ["type=cacheonly"]
 }
 
 target "validate-vendor" {
diff --git a/dockerfiles/lint.Dockerfile b/dockerfiles/lint.Dockerfile
new file mode 100644
index 00000000..e9d8c8f3
--- /dev/null
+++ b/dockerfiles/lint.Dockerfile
@@ -0,0 +1,16 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION=1.17
+ARG GOLANGCI_LINT_VERSION=v1.44
+
+FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint
+
+FROM golang:${GO_VERSION}-alpine AS base
+RUN apk add --no-cache gcc musl-dev
+WORKDIR /src
+
+FROM base
+RUN --mount=type=bind,target=. \
+  --mount=type=cache,target=/root/.cache \
+  --mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint \
+  golangci-lint run