diff --git a/.gitlab/ci/build-image.gitlab-ci.yml b/.gitlab/ci/build-image.gitlab-ci.yml
index a63f48f77880a4d2c9ec26a0915fabf38c8860b6..e1a37e4da5fda9cf116a9590a51b98b31d7f200a 100644
--- a/.gitlab/ci/build-image.gitlab-ci.yml
+++ b/.gitlab/ci/build-image.gitlab-ci.yml
@@ -1,4 +1,4 @@
-.build-ctageneric:
+.build-image:
   stage: build:image
   retry: 1
   rules:
@@ -14,12 +14,23 @@
   image:
     name: $IMAGE_DOCKER_IMAGE_BUILDER
     entrypoint: [""]
-  before_script:
+  variables:
+    DOCKERFILE:
+    IMAGE_NAME:
+    EXTRA_BUILD_ARGS:
+  script:
+    - echo "Authenticating against repo"
     - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"${DOCKER_LOGIN_USERNAME}\",\"password\":\"${DOCKER_LOGIN_PASSWORD}\"}}}" > /kaniko/.docker/config.json
+    - echo "Building ${DOCKERFILE} and pushing resulting image to ${CI_REGISTRY}/cta/${IMAGE_NAME}:${CTA_BUILD_ID}"
+    - /kaniko/executor --context $CI_PROJECT_DIR
+                       --dockerfile $DOCKERFILE
+                       --destination ${CI_REGISTRY}/cta/${IMAGE_NAME}:${CTA_BUILD_ID}
+                       ${EXTRA_BUILD_ARGS}
+    - echo "Image pushed successfully to ${CI_REGISTRY}/cta/${IMAGE_NAME}:${CTA_BUILD_ID}"
 
 build-ctageneric-from-local-rpms:
   extends:
-    - .build-ctageneric
+    - .build-image
   needs:
     - job: build-cta-rpm
     - job: modify-project-json
@@ -29,26 +40,21 @@ build-ctageneric-from-local-rpms:
       when: never
     - if: $PIPELINE_TYPE == "IMAGE_FROM_CTA_VERSION"
       when: never
-    - !reference [.build-ctageneric, rules]
+    - !reference [.build-image, rules]
   variables:
-    DOCKERFILE: continuousintegration/docker/${PLATFORM}/local-rpms.Dockerfile
-  script:
-    - echo "Building image for tag $CTA_BUILD_ID"
-    - echo "Image tag ${CI_REGISTRY}/cta/ctageneric:${CTA_BUILD_ID}"
+    DOCKERFILE: continuousintegration/docker/${PLATFORM}/dev-local-rpms.Dockerfile
+    IMAGE_NAME: ctageneric
+    EXTRA_BUILD_ARGS: "--build-arg USE_INTERNAL_REPOS=${USE_INTERNAL_REPOS}"
+  before_script:
     # The RPMs come from the artifacts which come as a symbolic link
-    # that poitns outside of the build context. We need to copy them
+    # that points outside of the build context. We need to copy them
     # to a reachable place from the build context.
     - mkdir -p image_rpms
     - cp -r build_rpm/RPM/RPMS/x86_64 image_rpms
-    - /kaniko/executor --context $CI_PROJECT_DIR
-                       --dockerfile $DOCKERFILE
-                       --destination ${CI_REGISTRY}/cta/ctageneric:${CTA_BUILD_ID}
-                       --build-arg USE_INTERNAL_REPOS=${USE_INTERNAL_REPOS}
-    - echo "Image pushed successfully to ${CI_REGISTRY}/cta/ctageneric:${CTA_BUILD_ID}"
 
 build-ctageneric-from-remote-rpms:
   extends:
-    - .build-ctageneric
+    - .build-image
   needs:
     - job: validate-pipeline-variables
     - job: modify-project-json
@@ -57,20 +63,51 @@ build-ctageneric-from-remote-rpms:
     - if: $PIPELINE_TYPE == "REGR_AGAINST_CTA_VERSION"
     - if: $PIPELINE_TYPE == "IMAGE_FROM_CTA_VERSION"
     - when: never
-    - !reference [.build-ctageneric, rules]
+    - !reference [.build-image, rules]
   variables:
-    DOCKERFILE: continuousintegration/docker/${PLATFORM}/remote-rpms.Dockerfile
-  script:
-    # If .$PLATFORM (e.g. .el9) was not specified, attach it here
+    DOCKERFILE: continuousintegration/docker/${PLATFORM}/dev-remote-rpms.Dockerfile
+    IMAGE_NAME: ctageneric
+    EXTRA_BUILD_ARGS: "--build-arg USE_INTERNAL_REPOS=${USE_INTERNAL_REPOS} --build-arg PUBLIC_REPO_VER=${CUSTOM_CTA_VERSION}.${PLATFORM}"
+
+###############################################
+# Immutable images
+###############################################
+
+build-images:
+  allow_failure: true # Don't block the pipeline
+  extends:
+    - .build-image
+  needs:
+    - job: build-cta-rpm
+    - job: modify-project-json
+      optional: true
+  rules:
+    - if: $PIPELINE_TYPE == "REGR_AGAINST_CTA_VERSION"
+      when: never
+    - if: $PIPELINE_TYPE == "IMAGE_FROM_CTA_VERSION"
+      when: never
+    - if: $PIPELINE_TYPE == "SYSTEM_TEST_ONLY"
+      when: never
+    - when: manual
+  variables:
+    TARGET_NAME:
+    DOCKERFILE: continuousintegration/docker/${PLATFORM}/prod.Dockerfile
+    EXTRA_BUILD_ARGS: "--build-arg USE_INTERNAL_REPOS=${USE_INTERNAL_REPOS} --target ${TARGET_NAME}"
+    # Note that this ctageneric is important here: it ensures the images end up in a private registry
+    # These images must absolutely not end up in a public registry, as they contain Oracle RPMs (which we cannot distribute)
+    IMAGE_NAME: ctageneric/${TARGET_NAME}
+  before_script:
+    # For the Postgres scheduler, choose a different Dockerfile and add the "-pg" suffix to the image
     - |
-      if [[ "$CUSTOM_CTA_VERSION" != *.${PLATFORM} ]]; then
-        CUSTOM_CTA_VERSION="${CUSTOM_CTA_VERSION}.${PLATFORM}"
+      if [[ "${SCHEDULER_TYPE}" == "pgsched" ]]; then
+        DOCKERFILE="continuousintegration/docker/${PLATFORM}/prod-pg.Dockerfile"
+        IMAGE_NAME="${IMAGE_NAME}-pg"
       fi
-    - echo "Building image with CTA ${CUSTOM_CTA_VERSION} RPMs"
-    - echo "Image tag ${CI_REGISTRY}/cta/ctageneric:${CTA_BUILD_ID}"
-    - /kaniko/executor --context $CI_PROJECT_DIR
-                       --dockerfile $DOCKERFILE
-                       --destination ${CI_REGISTRY}/cta/ctageneric:${CTA_BUILD_ID}
-                       --build-arg "PUBLIC_REPO_VER=${CUSTOM_CTA_VERSION}"
-                       --build-arg USE_INTERNAL_REPOS=${USE_INTERNAL_REPOS}
-    - echo "Image pushed successfully to ${CI_REGISTRY}/cta/ctageneric:${CTA_BUILD_ID}"
+    # The RPMs come from the artifacts which come as a symbolic link
+    # that points outside of the build context. We need to copy them
+    # to a reachable place from the build context.
+    - mkdir -p image_rpms
+    - cp -r build_rpm/RPM/RPMS/x86_64 image_rpms
+  parallel:
+    matrix:
+      - TARGET_NAME: [cta-taped, cta-rmcd, cta-maintd, cta-frontend-xrd, cta-frontend-grpc, cta-tools-xrd, cta-tools-grpc]
diff --git a/continuousintegration/build/build_image.sh b/continuousintegration/build/build_image.sh
index ad6931f613640262f7478ddc59807217a9ded08b..bcc25330c7808c1170c631cf1c3e44151fa2253d 100755
--- a/continuousintegration/build/build_image.sh
+++ b/continuousintegration/build/build_image.sh
@@ -32,7 +32,7 @@ usage() {
   echo "  -n, --name:                         The Docker image name. Defaults to ctageneric"
   echo "  -l, --load-into-minikube:           Takes the image from the podman registry and ensures that it is present in the image registry used by minikube."
   echo "  -c, --container-runtime <runtime>:  The container runtime to use for the build container. Defaults to podman."
-  echo "      --dockerfile <path>:            Path to the Dockerfile (default: 'continuousintegration/docker/{defaultplatform}/local-rpms.Dockerfile'). Should be relative to the repository root."
+  echo "      --dockerfile <path>:            Path to the Dockerfile (default: 'continuousintegration/docker/{defaultplatform}/dev-local-rpms.Dockerfile'). Should be relative to the repository root."
   echo "      --use-internal-repos:           Use the internal yum repos instead of the public repos."
   echo
   exit 1
@@ -48,7 +48,7 @@ buildImage() {
   local container_runtime="podman"
   local rpm_default_src="image_rpms"
   local defaultPlatform=$(jq -r .dev.defaultPlatform "${project_root}/project.json")
-  local dockerfile="continuousintegration/docker/${defaultPlatform}/local-rpms.Dockerfile"
+  local dockerfile="continuousintegration/docker/${defaultPlatform}/dev-local-rpms.Dockerfile"
   local load_into_minikube=false
   # Note that the capitalization here is intentional as this is passed directly as a build arg
   local use_internal_repos="FALSE"
diff --git a/continuousintegration/docker/README.md b/continuousintegration/docker/README.md
index fae60aa4653e5d9280309dbe92add875ef1246e8..e1468b34e8192879c49d71df0b6bf2e5ec718890 100644
--- a/continuousintegration/docker/README.md
+++ b/continuousintegration/docker/README.md
@@ -1,8 +1,17 @@
 # Docker
 
 This directory contains for each platform a set of file. Every platform must contain the following files:
+
 - `etc/yum.repos.d-internal/*.repo` for the internal yum/dnf repos
 - `etc/yum.repos.d-public/*.repo` for the public yum/dnf repos
 - `build.Dockerfile` dockerfile for creating the build image used in `build_deploy.sh`
-- `local-rpms.Dockerfile` dockerfile for creating an image based on locally-built RPMs
-- `remote-rpms.Dockerfile` dockerfile for creating an image based on a tagged CTA version with RPMs available in the remote testing repo
+- `dev-local-rpms.Dockerfile` dockerfile for creating an image based on locally-built RPMs. This image does not come with CTA installed and is meant only for dev environments.
+- `dev-remote-rpms.Dockerfile` dockerfile for creating an image based on a tagged CTA version with RPMs available in the remote testing repo. This image does not come with CTA installed and is meant only for dev environments.
+- `prod-pg.Dockerfile` dockerfile for creating an image per service based on locally-built RPMs (compiled with the Postgres scheduler). The images that can be built from this Dockerfile are immutable and are suitable for production.
+- `prod.Dockerfile` dockerfile for creating an image per service based on locally-built RPMs (compiled with the Objectstore scheduler). The images that can be built from this Dockerfile are immutable and are suitable for production.
+
+Note that this army of Dockerfiles should eventually go away. The goal is to only keep a `build.Dockerfile` for the build container and a `prod.Dockerfile` for building the CTA images.
+Both `dev` images will go, as these will be replaced by the immutable images. We no longer need the distinction between local and remote RPMs, because we can just grab the image of a previously published version directly.
+Finally, the current `prod.Dockerfile` will be replaced by `prod-pg.Dockerfile` once support for the Objectstore scheduler stops.
+
+Note that the Dockerfile naming convention is `<environment>[-<suffix>].Dockerfile`.
diff --git a/continuousintegration/docker/el9/local-rpms.Dockerfile b/continuousintegration/docker/el9/dev-local-rpms.Dockerfile
similarity index 100%
rename from continuousintegration/docker/el9/local-rpms.Dockerfile
rename to continuousintegration/docker/el9/dev-local-rpms.Dockerfile
diff --git a/continuousintegration/docker/el9/remote-rpms.Dockerfile b/continuousintegration/docker/el9/dev-remote-rpms.Dockerfile
similarity index 100%
rename from continuousintegration/docker/el9/remote-rpms.Dockerfile
rename to continuousintegration/docker/el9/dev-remote-rpms.Dockerfile
diff --git a/continuousintegration/docker/el9/prod-pg.Dockerfile b/continuousintegration/docker/el9/prod-pg.Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..267f4c6416ca2fc6e27748cdc43cc64085540302
--- /dev/null
+++ b/continuousintegration/docker/el9/prod-pg.Dockerfile
@@ -0,0 +1,183 @@
+# @project      The CERN Tape Archive (CTA)
+# @copyright    Copyright © 2023-2025 CERN
+# @license      This program is free software, distributed under the terms of the GNU General Public
+#               Licence version 3 (GPL Version 3), copied verbatim in the file "COPYING". You can
+#               redistribute it and/or modify it under the terms of the GPL Version 3, or (at your
+#               option) any later version.
+#
+#               This program is distributed in the hope that it will be useful, but WITHOUT ANY
+#               WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+#               PARTICULAR PURPOSE. See the GNU General Public License for more details.
+#
+#               In applying this licence, CERN does not waive the privileges and immunities
+#               granted to it by virtue of its status as an Intergovernmental Organization or
+#               submit itself to any jurisdiction.
+
+FROM gitlab-registry.cern.ch/linuxsupport/alma9-base:latest AS base
+
+ENV CTA_REPO_DIR="/opt/repo"
+ENV LOCAL_RPM_DIR="image_rpms"
+
+# Common repo configuration
+COPY continuousintegration/docker/el9/etc/yum.repos.d-internal/* /etc/yum.repos.d/
+
+# Core dependencies
+RUN dnf install -y \
+      python3-dnf-plugin-versionlock \
+      dnf-utils \
+      createrepo \
+      epel-release \
+      gdb \
+      jq \
+      krb5-workstation && \
+    chmod 0644 /etc/logrotate.d/*
+
+RUN dnf config-manager --enable epel --setopt="epel.priority=4"
+
+# User
+RUN useradd -m -u 1000 -g tape cta
+
+# Bring in prebuilt RPMs
+COPY ${LOCAL_RPM_DIR} ${CTA_REPO_DIR}/RPMS/x86_64
+
+# Create local CTA repo
+RUN createrepo "${CTA_REPO_DIR}" && \
+    echo -e "[cta-local-testing]\n\
+name=CTA repo with testing RPMs pointing to local artifacts\n\
+baseurl=file://${CTA_REPO_DIR}\n\
+gpgcheck=0\n\
+enabled=1\n\
+priority=2" > /etc/yum.repos.d/cta-local-testing.repo && \
+    dnf install -y cta-release && \
+    cta-versionlock apply
+
+RUN dnf install -y \
+  cta-debuginfo \
+  cta-debugsource
+
+
+###############################################
+# SERVICE cta-taped
+###############################################
+FROM base AS cta-taped
+
+# Ideally cta-tape-label should not be here
+# Something for later..
+RUN dnf install -y \
+      mt-st \
+      lsscsi \
+      sg3_utils \
+      cta-taped \
+      cta-tape-label \
+      cta-eosdf \
+      cta-taped-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+# Can this run as non-root?
+CMD ["/bin/bash", "-c", "runuser -c \"/usr/bin/cta-taped -c /etc/cta/cta-taped.conf --foreground --log-format=json --log-to-file=/var/log/cta/cta-taped.log\""]
+
+
+###############################################
+# SERVICE cta-rmcd
+###############################################
+FROM base AS cta-rmcd
+
+RUN dnf install -y \
+      mt-st \
+      mtx \
+      lsscsi \
+      sg3_utils \
+      cta-rmcd \
+      cta-smc \
+      cta-rmcd-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+# Can this can run as non-root?
+CMD ["/usr/bin/cta-rmcd", "-f", "/dev/smc"]
+
+###############################################
+# SERVICE cta-maintd
+###############################################
+FROM base AS cta-maintd
+
+RUN dnf install -y \
+      cta-maintd \
+      cta-maintd-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+USER cta
+CMD ["/usr/bin/cta-maintd", "--foreground", "--log-to-file=/var/log/cta/cta-maintd.log", "--log-format json", "--config /etc/cta/cta-maintd.conf"]
+
+###############################################
+# SERVICE cta-frontend-grpc
+###############################################
+FROM base AS cta-frontend-grpc
+
+RUN dnf install -y \
+      cta-frontend-grpc \
+      cta-frontend-grpc-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+USER cta
+CMD ["/bin/bash", "-c", "/usr/bin/cta-frontend-grpc >> /var/log/cta/cta-frontend-grpc.log"]
+
+
+###############################################
+# SERVICE cta-frontend-xrd
+###############################################
+FROM base AS cta-frontend-xrd
+
+RUN dnf install -y \
+      cta-frontend \
+      cta-frontend-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+USER cta
+CMD ["/bin/bash", "-c", "cd ~cta; xrootd -l /var/log/cta-frontend-xrootd.log -k fifo -n cta -c /etc/cta/cta-frontend-xrootd.conf -I v4"]
+
+###############################################
+# TOOLS cta-tools-grpc
+###############################################
+FROM base AS cta-tools-grpc
+
+RUN dnf install -y \
+      cta-admin-grpc \
+      cta-catalogueutils \
+      cta-scheduler-utils && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+ENTRYPOINT ["/bin/bash"]
+
+###############################################
+# TOOLS cta-tools-xrd
+###############################################
+FROM base AS cta-tools-xrd
+
+RUN dnf install -y \
+      cta-cli \
+      cta-catalogueutils \
+      cta-scheduler-utils && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+ENTRYPOINT ["/bin/bash"]
diff --git a/continuousintegration/docker/el9/prod.Dockerfile b/continuousintegration/docker/el9/prod.Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..46e2c7954dc6e6d8cea59cc59d6ecd8df26f97dc
--- /dev/null
+++ b/continuousintegration/docker/el9/prod.Dockerfile
@@ -0,0 +1,186 @@
+# @project      The CERN Tape Archive (CTA)
+# @copyright    Copyright © 2023-2025 CERN
+# @license      This program is free software, distributed under the terms of the GNU General Public
+#               Licence version 3 (GPL Version 3), copied verbatim in the file "COPYING". You can
+#               redistribute it and/or modify it under the terms of the GPL Version 3, or (at your
+#               option) any later version.
+#
+#               This program is distributed in the hope that it will be useful, but WITHOUT ANY
+#               WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+#               PARTICULAR PURPOSE. See the GNU General Public License for more details.
+#
+#               In applying this licence, CERN does not waive the privileges and immunities
+#               granted to it by virtue of its status as an Intergovernmental Organization or
+#               submit itself to any jurisdiction.
+
+FROM gitlab-registry.cern.ch/linuxsupport/alma9-base:latest AS base
+
+ENV CTA_REPO_DIR="/opt/repo"
+ENV LOCAL_RPM_DIR="image_rpms"
+
+# Common repo configuration
+COPY continuousintegration/docker/el9/etc/yum.repos.d-internal/* /etc/yum.repos.d/
+
+# Core dependencies
+RUN dnf install -y \
+      python3-dnf-plugin-versionlock \
+      dnf-utils \
+      createrepo \
+      epel-release \
+      gdb \
+      jq \
+      krb5-workstation && \
+    chmod 0644 /etc/logrotate.d/*
+
+RUN dnf config-manager --enable epel --setopt="epel.priority=4"
+
+# User
+RUN useradd -m -u 1000 -g tape cta
+
+# Bring in prebuilt RPMs
+COPY ${LOCAL_RPM_DIR} ${CTA_REPO_DIR}/RPMS/x86_64
+
+# Create local CTA repo
+RUN createrepo "${CTA_REPO_DIR}" && \
+    echo -e "[cta-local-testing]\n\
+name=CTA repo with testing RPMs pointing to local artifacts\n\
+baseurl=file://${CTA_REPO_DIR}\n\
+gpgcheck=0\n\
+enabled=1\n\
+priority=2" > /etc/yum.repos.d/cta-local-testing.repo && \
+    dnf install -y cta-release && \
+    cta-versionlock apply
+
+RUN dnf config-manager --enable ceph
+RUN dnf install -y \
+      ceph-common
+      cta-debuginfo \
+      cta-debugsource
+
+
+###############################################
+# SERVICE cta-taped
+###############################################
+FROM base AS cta-taped
+
+# Ideally cta-tape-label should not be here
+# Something for later..
+RUN dnf install -y \
+      mt-st \
+      lsscsi \
+      sg3_utils \
+      cta-taped \
+      cta-tape-label \
+      cta-eosdf \
+      cta-taped-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+# TODO: can this run as non-root?
+CMD ["/bin/bash", "-c", "runuser -c \"/usr/bin/cta-taped -c /etc/cta/cta-taped.conf --foreground --log-format=json --log-to-file=/var/log/cta/cta-taped.log\""]
+
+
+###############################################
+# SERVICE cta-rmcd
+###############################################
+FROM base AS cta-rmcd
+
+RUN dnf install -y \
+      mt-st \
+      mtx \
+      lsscsi \
+      sg3_utils \
+      cta-rmcd \
+      cta-smc \
+      cta-rmcd-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+# TODO: can this can run as non-root?
+CMD ["/usr/bin/cta-rmcd", "-f", "/dev/smc"]
+
+###############################################
+# SERVICE cta-maintd
+###############################################
+FROM base AS cta-maintd
+
+RUN dnf install -y \
+      cta-maintd \
+      cta-maintd-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+USER cta
+CMD ["/usr/bin/cta-maintd", "--foreground", "--log-to-file=/var/log/cta/cta-maintd.log", "--log-format json", "--config /etc/cta/cta-maintd.conf"]
+
+###############################################
+# SERVICE cta-frontend-grpc
+###############################################
+FROM base AS cta-frontend-grpc
+
+RUN dnf install -y \
+      cta-frontend-grpc \
+      cta-frontend-grpc-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+USER cta
+CMD ["/bin/bash", "-c", "/usr/bin/cta-frontend-grpc >> /var/log/cta/cta-frontend-grpc.log"]
+
+
+###############################################
+# SERVICE cta-frontend-xrd
+###############################################
+FROM base AS cta-frontend-xrd
+
+RUN dnf install -y \
+      cta-frontend \
+      cta-frontend-debuginfo && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+USER cta
+CMD ["/bin/bash", "-c", "cd ~cta; xrootd -l /var/log/cta-frontend-xrootd.log -k fifo -n cta -c /etc/cta/cta-frontend-xrootd.conf -I v4"]
+
+
+###############################################
+# TOOLS cta-tools-grpc
+###############################################
+FROM base AS cta-tools-grpc
+
+RUN dnf install -y \
+      cta-admin-grpc \
+      cta-catalogueutils \
+      cta-objectstore-tools && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+ENTRYPOINT ["/bin/bash"]
+
+###############################################
+# TOOLS cta-tools-xrd
+###############################################
+FROM base AS cta-tools-xrd
+
+RUN dnf install -y \
+      cta-cli \
+      cta-catalogueutils \
+      cta-objectstore-tools && \
+    dnf clean all
+
+# Remove the local RPMs to reduce size
+RUN rm -rf "${CTA_REPO_DIR}" && dnf clean all --enablerepo=\*
+
+ENTRYPOINT ["/bin/bash"]
diff --git a/continuousintegration/orchestration/helm/tpsrv/scripts/rmcd.sh b/continuousintegration/orchestration/helm/tpsrv/scripts/rmcd.sh
index c171811464734b78d69f851073735578d5aa2b4b..ac2ad1a633c4fc10df7c39d2b2080f7bcd8859ff 100755
--- a/continuousintegration/orchestration/helm/tpsrv/scripts/rmcd.sh
+++ b/continuousintegration/orchestration/helm/tpsrv/scripts/rmcd.sh
@@ -17,10 +17,6 @@
 
 echo "$(date '+%Y-%m-%d %H:%M:%S') [$(basename "${BASH_SOURCE[0]}")] Started"
 
-# Note that this sets the symbolic link for ALL containers, as /dev/ is shared
-# Consequently, that means that having multiple library devices is currently not supported
-ln -s /dev/${LIBRARY_DEVICE} /dev/smc
-
 # install RPMs
 dnf install -y mt-st mtx lsscsi sg3_utils cta-rmcd cta-smc
 
diff --git a/continuousintegration/orchestration/helm/tpsrv/scripts/taped.sh b/continuousintegration/orchestration/helm/tpsrv/scripts/taped.sh
index d529294ab5b249300abc8c9dd257474fdb9c6512..ebda7caaad47ccd1a85b69efecd0efb7ee82cd87 100755
--- a/continuousintegration/orchestration/helm/tpsrv/scripts/taped.sh
+++ b/continuousintegration/orchestration/helm/tpsrv/scripts/taped.sh
@@ -29,5 +29,5 @@ fi
 # the setresgid(-1, 1474, -1) and setresuid(-1, 14029, -1) system calls from
 # working correctly
 echo "$(date '+%Y-%m-%d %H:%M:%S') [$(basename "${BASH_SOURCE[0]}")] Ready"
-tail -F "/var/log/cta/cta-taped-${DRIVE_NAME}.log" &
-runuser -c "/usr/bin/cta-taped -c /etc/cta/cta-taped-${DRIVE_NAME}.conf --foreground --log-format=json --log-to-file=/var/log/cta/cta-taped-${DRIVE_NAME}.log"
+tail -F "/var/log/cta/cta-taped.log" &
+runuser -c "/usr/bin/cta-taped -c /etc/cta/cta-taped.conf --foreground --log-format=json --log-to-file=/var/log/cta/cta-taped.log"
diff --git a/continuousintegration/orchestration/helm/tpsrv/templates/configmaps/cta-taped.yaml b/continuousintegration/orchestration/helm/tpsrv/templates/configmaps/cta-taped.yaml
index 4121bcb79ff18916707f4e3c998c57b9e7f3a949..4f0738db537004d6654d2e8990e5930d58659e02 100644
--- a/continuousintegration/orchestration/helm/tpsrv/templates/configmaps/cta-taped.yaml
+++ b/continuousintegration/orchestration/helm/tpsrv/templates/configmaps/cta-taped.yaml
@@ -11,7 +11,7 @@ metadata:
   labels:
     {{-  include "common.labels.standard" $ | nindent 4 }}
 data:
-  cta-taped-{{ $drive.name }}.conf: |-
+  cta-taped.conf: |-
     # cta-taped setup
     taped BufferSizeBytes {{ $.Values.conf.taped.bufferSizeBytes }}
     taped BufferCount {{ $.Values.conf.taped.bufferCount }}
diff --git a/continuousintegration/orchestration/helm/tpsrv/templates/statefulset.yaml b/continuousintegration/orchestration/helm/tpsrv/templates/statefulset.yaml
index a10543c2a630a3e2b682a4626680c01b8d004fed..e238cff1ff2454a682cbf463c91cb06f36afc902 100644
--- a/continuousintegration/orchestration/helm/tpsrv/templates/statefulset.yaml
+++ b/continuousintegration/orchestration/helm/tpsrv/templates/statefulset.yaml
@@ -22,7 +22,7 @@ spec:
       labels:
         app.kubernetes.io/name: {{ $tpsrvName }}
         {{- include "common.labels.withoutname" $ | nindent 8 }}
-        cta/library-device: {{ .libraryDevice }}
+        cta/library-device: {{ .libraryDevice | quote }}
     spec:
       imagePullSecrets:
       {{- include "tpsrv.imagePullSecrets" $ | nindent 6 }}
@@ -86,6 +86,8 @@ spec:
         volumeMounts:
         - name: scripts-volume
           mountPath: /scripts
+        - name: smcdev
+          mountPath: /dev/smc
         {{ include "common.extraVolumeMounts" $ | nindent 8 }}
       # For each drive, spawn a separate taped container
       {{- range $index, $drive := .drives }}
@@ -137,8 +139,8 @@ spec:
         - name: scripts-volume
           mountPath: /scripts
         - name: cta-taped-config
-          mountPath: /etc/cta/cta-taped-{{ $drive.name }}.conf
-          subPath: cta-taped-{{ $drive.name }}.conf
+          mountPath: /etc/cta/cta-taped.conf
+          subPath: cta-taped.conf
         - name: catalogue-config
           mountPath: /etc/cta/cta-catalogue.conf
           subPath: cta-catalogue.conf
@@ -174,6 +176,10 @@ spec:
         {{ include "common.extraVolumeMounts" $ | nindent 8 }}
       {{- end }} # End of containers loop
       volumes:
+      - name: smcdev
+        hostPath:
+          path: /dev/{{ $libraryDevice }}
+          type: CharDevice
       - name: scripts-volume
         configMap:
           name: scripts-tpsrv
diff --git a/continuousintegration/orchestration/tests/compare_taped_config_to_dr_ls.py b/continuousintegration/orchestration/tests/compare_taped_config_to_dr_ls.py
index f43bc7dfcb3600acd220680321dfc29502cb5211..d3aea42c6a6a3d89540185aab9c496b68b589a11 100755
--- a/continuousintegration/orchestration/tests/compare_taped_config_to_dr_ls.py
+++ b/continuousintegration/orchestration/tests/compare_taped_config_to_dr_ls.py
@@ -25,7 +25,7 @@ def main():
     ns = args.namespace
 
     taped_config = run(
-        f"kubectl -n {ns} exec {CTA_TPSRV_POD} -c cta-taped-0 -- " "bash -c 'cat /etc/cta/cta-taped*.conf'"
+        f"kubectl -n {ns} exec {CTA_TPSRV_POD} -c cta-taped-0 -- " "bash -c 'cat /etc/cta/cta-taped.conf'"
     )
 
     drive_name = run(f"kubectl -n {ns} exec {CTA_TPSRV_POD} -c cta-taped-0 -- printenv DRIVE_NAME").strip()
diff --git a/continuousintegration/orchestration/tests/prepare_tests.sh b/continuousintegration/orchestration/tests/prepare_tests.sh
index f294d2f0705f4ef56e2e8ce2471f2c9b63117aec..1f5f5457045228f707572d9141b7b3ea3478578e 100755
--- a/continuousintegration/orchestration/tests/prepare_tests.sh
+++ b/continuousintegration/orchestration/tests/prepare_tests.sh
@@ -65,7 +65,7 @@ done
 # Get list of tape drives that have a tape server
 TAPEDRIVES_IN_USE=()
 for tapeserver in $(kubectl --namespace ${NAMESPACE} get pods | grep tpsrv | awk '{print $1}'); do
-  TAPEDRIVES_IN_USE+=($(kubectl --namespace ${NAMESPACE} exec ${tapeserver} -c cta-taped-0 -- bash -c "find /etc/cta | grep cta-taped- | xargs cat" | grep LogicalLibrary | awk 'NR==1 {print $3}'))
+  TAPEDRIVES_IN_USE+=($(kubectl --namespace ${NAMESPACE} exec ${tapeserver} -c cta-taped-0 -- bash -c "find /etc/cta | grep cta-taped.conf | xargs cat" | grep LogicalLibrary | awk 'NR==1 {print $3}'))
 done
 NB_TAPEDRIVES_IN_USE=${#TAPEDRIVES_IN_USE[@]}
 
diff --git a/continuousintegration/orchestration/tests/taped_refresh_log_fd.sh b/continuousintegration/orchestration/tests/taped_refresh_log_fd.sh
index 62daea7f95022cd97092d115b1632714dac54d3c..38a18b9a3ce61b77fd9d44081a0f96ec724ecf72 100755
--- a/continuousintegration/orchestration/tests/taped_refresh_log_fd.sh
+++ b/continuousintegration/orchestration/tests/taped_refresh_log_fd.sh
@@ -15,15 +15,9 @@
 #               granted to it by virtue of its status as an Intergovernmental Organization or
 #               submit itself to any jurisdiction.
 
-log_dir="/var/log/cta/"
 STRACE_SLEEP_SECS=2
 
-if [[ "$(find ${log_dir} -type f | wc -l)" -ne 1 ]]; then
-  echo "ERROR: More than one log file found at ${log_dir}."
-  exit 1
-fi
-
-log_file=$(find ${log_dir} -type f)
+log_file="/var/log/cta/cta-taped.log"
 
 # Install dependencies required for testing log rotation inside the tape server"
 dnf -y install strace lsof
diff --git a/continuousintegration/orchestration/tests/test_client.sh b/continuousintegration/orchestration/tests/test_client.sh
index e3b1fd9441599bbc2d6cff6957c2bc0078fd9445..47c8cf788e43bf662c021dbc5135a2dd8cc0f5dc 100755
--- a/continuousintegration/orchestration/tests/test_client.sh
+++ b/continuousintegration/orchestration/tests/test_client.sh
@@ -141,7 +141,7 @@ kubectl -n ${NAMESPACE} exec ${CLIENT_POD} -c client -- bash -c "${TEST_PRERUN}
 # Set the TAPES and DRIVE_NAME based on the config in CTA_TPSRV_POD
 echo "Reading library configuration from ${CTA_TPSRV_POD}"
 DRIVE_NAME=$(kubectl exec -n ${NAMESPACE} ${CTA_TPSRV_POD} -c cta-taped-0 -- printenv DRIVE_NAME)
-CTA_TAPED_LOG=/var/log/cta/cta-taped-${DRIVE_NAME}.log
+CTA_TAPED_LOG=/var/log/cta/cta-taped.log
 
 if kubectl -n ${NAMESPACE} exec ${CTA_TPSRV_POD} -c cta-taped-0 -- bash -c "grep -q 'unable to get the free disk space with the script' ${CTA_TAPED_LOG}"; then
   echo "Script unexpectedly failed to get free disk space"