diff --git a/Dockerfile b/Dockerfile
index f1c69e03b..f4874ed36 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,16 +4,26 @@ MAINTAINER Lotus Development Team
 
 RUN apt-get update && apt-get install -y ca-certificates build-essential clang ocl-icd-opencl-dev ocl-icd-libopencl1 jq libhwloc-dev
 
-ARG RUST_VERSION=nightly
 ENV XDG_CACHE_HOME="/tmp"
 
+### taken from https://github.com/rust-lang/docker-rust/blob/master/1.63.0/buster/Dockerfile
 ENV RUSTUP_HOME=/usr/local/rustup \
     CARGO_HOME=/usr/local/cargo \
-    PATH=/usr/local/cargo/bin:$PATH
+    PATH=/usr/local/cargo/bin:$PATH \
+    RUST_VERSION=1.63.0
 
-RUN wget "https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init"; \
+RUN set -eux; \
+    dpkgArch="$(dpkg --print-architecture)"; \
+    case "${dpkgArch##*-}" in \
+        amd64) rustArch='x86_64-unknown-linux-gnu'; rustupSha256='5cc9ffd1026e82e7fb2eec2121ad71f4b0f044e88bca39207b3f6b769aaa799c' ;; \
+        arm64) rustArch='aarch64-unknown-linux-gnu'; rustupSha256='e189948e396d47254103a49c987e7fb0e5dd8e34b200aa4481ecc4b8e41fb929' ;; \
+        *) echo >&2 "unsupported architecture: ${dpkgArch}"; exit 1 ;; \
+    esac; \
+    url="https://static.rust-lang.org/rustup/archive/1.25.1/${rustArch}/rustup-init"; \
+    wget "$url"; \
+    echo "${rustupSha256} *rustup-init" | sha256sum -c -; \
     chmod +x rustup-init; \
-    ./rustup-init -y --no-modify-path --profile minimal --default-toolchain $RUST_VERSION; \
+    ./rustup-init -y --no-modify-path --profile minimal --default-toolchain $RUST_VERSION --default-host ${rustArch}; \
     rm rustup-init; \
     chmod -R a+w $RUSTUP_HOME $CARGO_HOME; \
     rustup --version; \
@@ -22,6 +32,11 @@ RUN wget "https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rust
 
 COPY ./ /opt/filecoin
 WORKDIR /opt/filecoin
+
+### make configurable filecoin-ffi build
+ARG FFI_BUILD_FROM_SOURCE=0
+ENV FFI_BUILD_FROM_SOURCE=${FFI_BUILD_FROM_SOURCE}
+
 RUN make clean deps
 
 ARG RUSTFLAGS=""
@@ -35,14 +50,14 @@ MAINTAINER Lotus Development Team
 
 # Base resources
 COPY --from=lotus-builder /etc/ssl/certs                           /etc/ssl/certs
-COPY --from=lotus-builder /lib/x86_64-linux-gnu/libdl.so.2         /lib/
-COPY --from=lotus-builder /lib/x86_64-linux-gnu/librt.so.1         /lib/
-COPY --from=lotus-builder /lib/x86_64-linux-gnu/libgcc_s.so.1      /lib/
-COPY --from=lotus-builder /lib/x86_64-linux-gnu/libutil.so.1       /lib/
-COPY --from=lotus-builder /usr/lib/x86_64-linux-gnu/libltdl.so.7   /lib/
-COPY --from=lotus-builder /usr/lib/x86_64-linux-gnu/libnuma.so.1   /lib/
-COPY --from=lotus-builder /usr/lib/x86_64-linux-gnu/libhwloc.so.5  /lib/
-COPY --from=lotus-builder /usr/lib/x86_64-linux-gnu/libOpenCL.so.1 /lib/
+COPY --from=lotus-builder /lib/*/libdl.so.2         /lib/
+COPY --from=lotus-builder /lib/*/librt.so.1         /lib/
+COPY --from=lotus-builder /lib/*/libgcc_s.so.1      /lib/
+COPY --from=lotus-builder /lib/*/libutil.so.1       /lib/
+COPY --from=lotus-builder /usr/lib/*/libltdl.so.7   /lib/
+COPY --from=lotus-builder /usr/lib/*/libnuma.so.1   /lib/
+COPY --from=lotus-builder /usr/lib/*/libhwloc.so.5  /lib/
+COPY --from=lotus-builder /usr/lib/*/libOpenCL.so.1 /lib/
 
 RUN useradd -r -u 532 -U fc \
  && mkdir -p /etc/OpenCL/vendors \