diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3d42cd041..a6dd23772 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,9 @@ jobs:
     if: "!startsWith(github.ref, 'refs/tags/') && github.ref != 'refs/heads/master'"
 
   Test:
+    # The custom image here contains pre-built libraries for leveldb and
+    # rocksdb, which are needed to build and test those modules.
+    # To update the container image, see docker.yml.
     runs-on: ubuntu-latest
     container: tendermintdev/docker-tm-db-testing
     steps:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index a675ecb6c..1eb94db47 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,3 +1,11 @@
+# This workflow builds and pushes a new version of the build container image
+# when the tools directory changes on master. Edit tools/Dockerfile.
+#
+# This workflow does not push a new image until it is merged, so tests that
+# depend on changes in this image will not pass until this workflow succeeds.
+# For that reason, changes here should be done in a separate PR in advance of
+# work that depends on them.
+
 name: Build & Push TM-DB-Testing
 on:
   pull_request:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b1f128ae8..c291823ed 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -7,13 +7,17 @@ on:
 
 jobs:
   golangci:
+    # We need to run the linter on the same image we use for building, since it
+    # needs the C libraries installed for the dependencies to typecheck.
     runs-on: ubuntu-latest
     container: tendermintdev/docker-tm-db-testing
     steps:
       - uses: actions/checkout@v2
       - uses: golangci/golangci-lint-action@v2.5.2
         with:
-          # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
+          # Required: the version of golangci-lint is required and must be
+          # specified without patch version: we always use the latest patch
+          # version.
           version: v1.30
           args: --timeout 10m
           github-token: ${{ secrets.github_token }}
diff --git a/tools/Dockerfile b/tools/Dockerfile
index c34f1c159..855414aab 100644
--- a/tools/Dockerfile
+++ b/tools/Dockerfile
@@ -1,31 +1,44 @@
-FROM golang:1.16-alpine
+# This file defines the container image used to build and test tm-db in CI.
+# The CI workflows use the latest tag of tendermintdev/docker-tm-db-testing
+# built from these settings.
+#
+# The jobs defined in the Build & Push workflow will build and update the image
+# when changes to this file are merged.  If you have other changes that require
+# updates here, merge the changes here first and let the image get updated (or
+# push a new version manually) before PRs that depend on them.
+
+FROM golang:1.17-bullseye AS build
 
 ENV LD_LIBRARY_PATH=/usr/local/lib
 
-RUN apk add bash build-base bzip2-dev gflags-dev linux-headers \
-            perl snappy-dev util-linux wget zlib-dev zstd-dev
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libbz2-dev libgflags-dev libsnappy-dev libzstd-dev zlib1g-dev \
+    make tar wget
+
+FROM build AS install
+ARG LEVELDB=1.20
+ARG ROCKSDB=6.24.2
 
 # Install cleveldb
 RUN \
-  wget -q https://github.com/google/leveldb/archive/v1.20.tar.gz \
-  && tar xvf v1.20.tar.gz \
-  && cd leveldb-1.20 \
+  wget -q https://github.com/google/leveldb/archive/v${LEVELDB}.tar.gz \
+  && tar xvf v${LEVELDB}.tar.gz \
+  && cd leveldb-${LEVELDB} \
   && make \
   && cp -a out-static/lib* out-shared/lib* /usr/local/lib \
   && cd include \
   && cp -a leveldb /usr/local/include \
-  && ldconfig $LD_LIBRARY_PATH \
+  && ldconfig \
   && cd ../.. \
-  && rm -rf v1.20.tar.gz leveldb-1.20
+  && rm -rf v${LEVELDB}.tar.gz leveldb-${LEVELDB}
 
 # Install Rocksdb
 RUN \
-  wget -q https://github.com/facebook/rocksdb/archive/v6.6.4.tar.gz \
-  && tar -zxf v6.6.4.tar.gz \
-  && cd rocksdb-6.6.4 \
-  && sed -i'' 's/install -C/install -c/g' Makefile \
+  wget -q https://github.com/facebook/rocksdb/archive/v${ROCKSDB}.tar.gz \
+  && tar -zxf v${ROCKSDB}.tar.gz \
+  && cd rocksdb-${ROCKSDB} \
   && DEBUG_LEVEL=0 make -j4 shared_lib \
   && make install-shared \
-  && ldconfig $LD_LIBRARY_PATH \
+  && ldconfig \
   && cd .. \
-  && rm -rf v6.6.4.tar.gz rocksdb-6.6.4
+  && rm -rf v${ROCKSDB}.tar.gz rocksdb-${ROCKSDB}