diff --git a/cloud-init.sh b/cloud-init.sh
index 21111b9..d4cabeb 100644
--- a/cloud-init.sh
+++ b/cloud-init.sh
@@ -6,58 +6,9 @@
 #runcmd:
 #  - curl -fsSL https://raw.githubusercontent.com/sneak/hacks/master/cloud-init.sh | bash
 
-#exec 1 2>&1 | tee -a ${LOG_FILE}
-
 export DEBIAN_FRONTEND=noninteractive
 apt-get update
-apt-get -y upgrade
-apt-get -y install vim byobu screen build-essential git mosh bash-completion golang-go python-pip python3-pip
-
-pip3 install --upgrade pip
-
-pip3 install awscli pipenv aws-shell
-
-curl -L https://github.com/docker/machine/releases/download/v0.14.0/docker-machine-`uname -s`-`uname -m` > /usr/local/bin/docker-machine
-chmod +x /usr/local/bin/docker-machine
-
-# create user if doesn't exist
-if [[ ! -d /home/sneak ]]; then
-    useradd -m -s /bin/bash sneak
-    usermod -a -G sudo sneak
-    echo "sneak ALL=NOPASSWD:ALL" > /etc/sudoers.d/sneak
-fi
-
-# run the rest as sneak:
-sudo -H -u sneak bash <<EOF
-
-export HOME=/home/sneak
-
-if [[ ! -d ~/.ssh ]]; then
-    mkdir -p ~/.ssh
-fi
-
-if [[ ! -e ~/.ssh/sneak.keys ]]; then
-    cd ~/.ssh && \
-    wget https://github.com/sneak.keys && \
-    cat *.keys > authorized_keys
-fi
-
-if [[ ! -d ~/hacks ]]; then
-    cd ~
-    git clone https://github.com/sneak/hacks.git
-fi
-
-curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh | bash
-
-export NVM_DIR="$HOME/.nvm"
-[ -s "$NVM_DIR/nvm.sh" ] && source "$NVM_DIR/nvm.sh"
-nvm install node
-
-mkdir -p ~/.local/bashrc.d
-mkdir -p ~/.local/profile.d
-
-mv ~/.profile ~/.local/profile.d/999.distro.profile.sh
-mv ~/.bashrc ~/.local/bashrc.d/999.distro.bashrc.sh
-
-rsync -avP /home/sneak/hacks/homedir.skel/ /home/sneak/
-EOF
+apt-get -y install git
+git clone https://github.com/sneak/hacks.git /var/tmp/hacks
+cd /var/tmp/hacks/provision-workbox
+bash main.sh
diff --git a/provision.workbox/Ubuntu-16.04-packages.txt b/provision.workbox/Ubuntu-16.04-packages.txt
new file mode 100644
index 0000000..b97dd77
--- /dev/null
+++ b/provision.workbox/Ubuntu-16.04-packages.txt
@@ -0,0 +1,10 @@
+bash-completion
+build-essential
+byobu
+git
+golang-go
+mosh
+python-pip
+python3-pip
+screen
+vim
diff --git a/provision.workbox/main.sh b/provision.workbox/main.sh
new file mode 100644
index 0000000..c12b409
--- /dev/null
+++ b/provision.workbox/main.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+#exec 1 2>&1 | tee -a ${LOG_FILE}
+
+if which lsb_release; then
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get -y upgrade
+    apt-get -y install $(cat $(lsb_release -i -s)-$(lsb_release -r -s)-packages.txt)
+fi
+
+pip3 install --upgrade pip
+
+URLBASE="https://github.com/docker/machine/releases/download/v0.14.0"
+URL="$URLBASE/docker-machine-$(uname -s)-$(uname -m)"
+curl -L $URL > /usr/local/bin/docker-machine
+chmod +x /usr/local/bin/docker-machine
+
+if [[ ! -d /home/sneak ]]; then
+    useradd -m -s /bin/bash sneak
+    usermod -a -G sudo sneak
+    echo "sneak ALL=NOPASSWD:ALL" > /etc/sudoers.d/sneak
+fi
+
+# run the rest as sneak:
+sudo -H -u sneak bash user-setup.sh
diff --git a/provision.workbox/user-setup.sh b/provision.workbox/user-setup.sh
new file mode 100644
index 0000000..c78d995
--- /dev/null
+++ b/provision.workbox/user-setup.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+export HOME=/home/sneak
+
+# install python3 packages
+pip3 install --user awscli awsebcli virtualenv pipenv aws-shell
+
+# install nvm
+curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh | bash
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && source "$NVM_DIR/nvm.sh"
+nvm install node
+
+if [[ ! -d ~/.ssh ]]; then
+    mkdir -p ~/.ssh
+fi
+
+if [[ ! -e ~/.ssh/sneak.keys ]]; then
+    cd ~/.ssh && \
+    wget https://github.com/sneak.keys && \
+    cat *.keys > authorized_keys
+fi
+
+if [[ ! -d ~/hacks ]]; then
+    cd ~
+    git clone https://github.com/sneak/hacks.git
+fi
+mkdir -p ~/.local/bashrc.d
+mkdir -p ~/.local/profile.d
+
+mv ~/.profile ~/.local/profile.d/000.distro.profile.sh
+mv ~/.bashrc ~/.local/bashrc.d/000.distro.bashrc.sh
+
+rsync -avP /home/sneak/hacks/homedir.skel/ /home/sneak/