diff --git a/cmd/orbit/orbit.go b/cmd/orbit/orbit.go
index 1ebcb37352..807ac3b886 100644
--- a/cmd/orbit/orbit.go
+++ b/cmd/orbit/orbit.go
@@ -41,35 +41,42 @@ func main() {
 	}
 	app.Flags = []cli.Flag{
 		&cli.StringFlag{
-			Name:  "root-dir",
-			Usage: "Root directory for Orbit state",
-			Value: defaultRootDir,
+			Name:    "root-dir",
+			Usage:   "Root directory for Orbit state",
+			Value:   defaultRootDir,
+			EnvVars: []string{"ORBIT_ROOT_DIR"},
 		},
 		&cli.BoolFlag{
-			Name:  "insecure",
-			Usage: "Disable TLS certificate verification",
+			Name:    "insecure",
+			Usage:   "Disable TLS certificate verification",
+			EnvVars: []string{"ORBIT_INSECURE"},
 		},
 		&cli.StringFlag{
-			Name:  "fleet-url",
-			Usage: "URL (host:port) to Fleet server",
+			Name:    "fleet-url",
+			Usage:   "URL (host:port) of Fleet server",
+			EnvVars: []string{"ORBIT_FLEET_URL"},
 		},
 		&cli.StringFlag{
-			Name:  "tuf-url",
-			Usage: "URL to TUF update server",
-			Value: tufURL,
+			Name:    "tuf-url",
+			Usage:   "URL of TUF update server",
+			Value:   tufURL,
+			EnvVars: []string{"ORBIT_TUF_URL"},
 		},
 		&cli.StringFlag{
-			Name:  "enroll-secret",
-			Usage: "Enroll secret for authenticating to Fleet server",
+			Name:    "enroll-secret",
+			Usage:   "Enroll secret for authenticating to Fleet server",
+			EnvVars: []string{"ENROLL_SECRET"},
 		},
 		&cli.StringFlag{
-			Name:  "osqueryd-version",
-			Usage: "Version of osqueryd to use",
-			Value: "stable",
+			Name:    "osqueryd-version",
+			Usage:   "Version of osqueryd to use",
+			Value:   "stable",
+			EnvVars: []string{"ORBIT_OSQUERYD_VERSION"},
 		},
 		&cli.BoolFlag{
-			Name:  "debug",
-			Usage: "Enable debug logging",
+			Name:    "debug",
+			Usage:   "Enable debug logging",
+			EnvVars: []string{"ORBIT_DEBUG"},
 		},
 	}
 	app.Action = func(c *cli.Context) error {
diff --git a/tools/ubuntu/Dockerfile b/tools/ubuntu/Dockerfile
new file mode 100644
index 0000000000..676b6cb488
--- /dev/null
+++ b/tools/ubuntu/Dockerfile
@@ -0,0 +1,5 @@
+FROM ubuntu
+
+RUN apt-get update &&\
+    apt-get install -y ca-certificates &&\
+    rm -rf /var/lib/apt/lists/*