diff --git a/core/admin/requirements-dev.txt b/core/admin/requirements-dev.txt
deleted file mode 100644
index 5bf57874..00000000
--- a/core/admin/requirements-dev.txt
+++ /dev/null
@@ -1,28 +0,0 @@
-Flask
-Flask-Login
-Flask-SQLAlchemy
-Flask-bootstrap
-Flask-Babel
-Flask-migrate
-Flask-script
-Flask-wtf
-Flask-debugtoolbar
-limits
-redis
-WTForms-Components
-socrate
-passlib
-gunicorn
-tabulate
-PyYAML
-PyOpenSSL
-Pygments
-dnspython
-tenacity
-mysql-connector-python
-idna
-srslib
-marshmallow
-flask-marshmallow
-marshmallow-sqlalchemy
-xmltodict
diff --git a/core/base/Dockerfile b/core/base/Dockerfile
index cd590596..52f0bd3a 100644
--- a/core/base/Dockerfile
+++ b/core/base/Dockerfile
@@ -4,11 +4,14 @@
 ARG DISTRO=alpine:3.14.5
 FROM $DISTRO as system
 
-ENV TZ Etc/UTC
-ENV LANG C.UTF-8
+ENV TZ=Etc/UTC LANG=C.UTF-8
+
+ARG MAILU_UID=1000
+ARG MAILU_GID=1000
 
 RUN set -euxo pipefail \
-  ; adduser -s /bin/bash -Dh /app -k /var/empty -u 1000 -g mailu app \
+  ; addgroup -Sg ${MAILU_GID} mailu \
+  ; adduser -Sg ${MAILU_UID} -G mailu -h /app -g "mailu app" -s /bin/bash mailu \
   ; apk add --no-cache bash ca-certificates python3 tzdata
 
 WORKDIR /app
@@ -21,31 +24,26 @@ FROM system as build
 
 ENV VIRTUAL_ENV=/app/venv
 
+COPY requirements-*.txt ./
+
 RUN set -euxo pipefail \
   ; apk add --no-cache py3-pip \
   ; python3 -m venv ${VIRTUAL_ENV} \
-  ; venv/bin/pip install --no-cache-dir --upgrade --no-warn-script-location pip wheel
+  ; ${VIRTUAL_ENV}/bin/pip install --no-cache-dir -r requirements-build.txt
 
 ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
 
 COPY libs/ libs/
-COPY --from=core ./ core/
-COPY --from=optional ./ optional/
 
 RUN set -euxo pipefail \
-  ; grep -hEv '(podop|socrate)==' core/*/requirements.txt optional/*/requirements.txt \
-    | sort -u >libs/requirements.txt \
-\
-  ; venv/bin/pip install --no-cache-dir -r libs/requirements.txt \
+  ; pip install --no-cache-dir -r requirements-prod.txt \
  || ( \
       apk add --no-cache --virtual .build-deps \
-        build-base cargo gcc libffi-dev libressl-dev mariadb-connector-c-dev \
-        musl-dev postgresql-dev python3-dev \
-       ; venv/bin/pip install --no-cache-dir -r libs/requirements.txt \
-       ; apk del .build-deps \
-  ) \
-\
-  ; venv/bin/pip freeze > venv/requirements.txt
+          build-base cargo gcc libffi-dev libressl-dev mariadb-connector-c-dev \
+          musl-dev postgresql-dev python3-dev \
+    ; pip install --no-cache-dir -r requirements-prod.txt \
+    ; apk del .build-deps \
+  )
 
 
 # base mailu image
diff --git a/core/base/requirements-build.txt b/core/base/requirements-build.txt
new file mode 100644
index 00000000..2858969f
--- /dev/null
+++ b/core/base/requirements-build.txt
@@ -0,0 +1,3 @@
+pip==22.2.2
+setuptools==65.4.1
+wheel==0.37.1
diff --git a/core/base/requirements-dev.txt b/core/base/requirements-dev.txt
new file mode 100644
index 00000000..2fb4352f
--- /dev/null
+++ b/core/base/requirements-dev.txt
@@ -0,0 +1,53 @@
+# core/base
+libs/podop
+libs/socrate
+
+# core/admin
+alembic
+Babel
+click
+dnspython
+Flask
+Flask-Babel
+Flask-Bootstrap
+Flask-DebugToolbar
+Flask-Login
+flask-marshmallow
+Flask-Migrate
+Flask-SQLAlchemy
+Flask-WTF
+gunicorn
+idna
+itsdangerous
+limits
+marshmallow
+marshmallow-sqlalchemy
+mysql-connector-python
+passlib
+psycopg2-binary
+Pygments
+pyOpenSSL
+PyYAML
+redis
+SQLAlchemy
+srslib
+tabulate
+tenacity
+validators
+Werkzeug
+WTForms
+WTForms-Components
+xmltodict
+
+# core/nginx
+watchdog
+
+# core/postfix
+postfix-mta-sts-resolver
+
+# optional/fetchmail
+requests
+
+# optional/radicale
+radicale
+
diff --git a/core/admin/requirements.txt b/core/base/requirements-prod.txt
similarity index 74%
rename from core/admin/requirements.txt
rename to core/base/requirements-prod.txt
index 297c6902..fbbce5d5 100644
--- a/core/admin/requirements.txt
+++ b/core/base/requirements-prod.txt
@@ -1,19 +1,24 @@
+aiodns==3.0.0
+aiohttp==3.8.3
+aiosignal==1.2.0
 alembic==1.7.4
 appdirs==1.4.4
+async-timeout==4.0.2
+attrs==22.1.0
 Babel==2.9.1
 bcrypt==3.2.0
 blinker==1.4
 CacheControl==0.12.9
 certifi==2021.10.8
-# cffi==1.15.0
+cffi==1.15.1
 chardet==4.0.0
+charset-normalizer==2.0.12
 click==8.0.3
 colorama==0.4.4
 contextlib2==21.6.0
 cryptography==35.0.0
 decorator==5.1.0
-# distlib==0.3.1
-# distro==1.5.0
+defusedxml==0.7.1
 dnspython==2.1.0
 dominate==2.6.0
 email-validator==1.1.3
@@ -28,6 +33,7 @@ Flask-Migrate==3.1.0
 Flask-Script==2.0.6
 Flask-SQLAlchemy==2.5.1
 Flask-WTF==0.15.1
+frozenlist==1.3.1
 greenlet==1.1.2
 gunicorn==20.1.0
 html5lib==1.1
@@ -38,31 +44,34 @@ itsdangerous==2.0.1
 Jinja2==3.0.2
 limits==1.5.1
 lockfile==0.12.2
-Mako==1.1.5
+Mako==1.2.3
 MarkupSafe==2.0.1
 marshmallow==3.14.0
 marshmallow-sqlalchemy==0.26.1
 msgpack==1.0.2
-# mysqlclient==2.0.3
+multidict==6.0.2
 mysql-connector-python==8.0.25
 ordered-set==4.0.2
-# packaging==20.9
 passlib==1.7.4
-# pep517==0.10.0
+podop @ file:///app/libs/podop
+postfix-mta-sts-resolver==1.0.1
 progress==1.6
-#psycopg2==2.9.1
+protobuf==4.21.7
 psycopg2-binary==2.9.3
+pycares==4.2.2
 pycparser==2.20
 Pygments==2.10.0
 pyOpenSSL==21.0.0
 pyparsing==3.0.4
+python-dateutil==2.8.2
 pytz==2021.3
 PyYAML==6.0
+Radicale==3.1.8
 redis==3.5.3
 requests==2.26.0
 retrying==1.3.3
-# six==1.15.0
-socrate==0.2.0
+six==1.16.0
+socrate @ file:///app/libs/socrate
 SQLAlchemy==1.4.26
 srslib==0.1.4
 tabulate==0.8.9
@@ -71,8 +80,11 @@ toml==0.10.2
 urllib3==1.26.7
 validators==0.18.2
 visitor==0.1.3
+vobject==0.9.6.1
+watchdog==2.1.9
 webencodings==0.5.1
 Werkzeug==2.0.2
 WTForms==2.3.3
 WTForms-Components==0.10.5
 xmltodict==0.12.0
+yarl==1.8.1
diff --git a/core/base/requirements.txt b/core/base/requirements.txt
deleted file mode 100644
index 0e537e6a..00000000
--- a/core/base/requirements.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-libs/podop/
-libs/socrate/
diff --git a/core/dovecot/requirements.txt b/core/dovecot/requirements.txt
deleted file mode 100644
index 16005f74..00000000
--- a/core/dovecot/requirements.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-podop==0.2.5
-socrate==0.2.0
diff --git a/core/nginx/requirements.txt b/core/nginx/requirements.txt
deleted file mode 100644
index c96c3bb8..00000000
--- a/core/nginx/requirements.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-socrate==0.2.0
-watchdog==2.1.9
diff --git a/core/postfix/requirements.txt b/core/postfix/requirements.txt
deleted file mode 100644
index 2d9b8135..00000000
--- a/core/postfix/requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-podop==0.2.5
-postfix-mta-sts-resolver==1.1.4
-socrate==0.2.0
diff --git a/core/rspamd/requirements.txt b/core/rspamd/requirements.txt
deleted file mode 100644
index be4b0107..00000000
--- a/core/rspamd/requirements.txt
+++ /dev/null
@@ -1 +0,0 @@
-socrate==0.2.0
diff --git a/optional/fetchmail/requirements.txt b/optional/fetchmail/requirements.txt
deleted file mode 100644
index a8ed785e..00000000
--- a/optional/fetchmail/requirements.txt
+++ /dev/null
@@ -1 +0,0 @@
-requests==2.26.0
diff --git a/optional/radicale/requirements.txt b/optional/radicale/requirements.txt
deleted file mode 100644
index fc61502c..00000000
--- a/optional/radicale/requirements.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-pytz==2021.3
-radicale~=3.0