diff --git a/distro/debian/debian.go b/distro/debian/debian.go
index 4a5c0c1..bb95623 100644
--- a/distro/debian/debian.go
+++ b/distro/debian/debian.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/rs/zerolog/log"
 
+	"code.dumpstack.io/tools/out-of-tree/cache"
 	"code.dumpstack.io/tools/out-of-tree/config"
 	"code.dumpstack.io/tools/out-of-tree/container"
 	"code.dumpstack.io/tools/out-of-tree/fs"
@@ -307,3 +308,41 @@ func ContainerVolumes(km config.KernelMask, pkgname string) (volumes container.V
 
 	return
 }
+
+func InstallCommands(km config.KernelMask, pkgname string) (cmds []string, err error) {
+	dk, err := getCachedKernel(pkgname + ".deb")
+	if err != nil {
+		return
+	}
+
+	for _, pkg := range dk.Packages() {
+		found, newurl := cache.PackageURL(
+			km.DistroType,
+			pkg.Deb.URL,
+		)
+		if found {
+			log.Debug().Msgf("cached deb found %s", newurl)
+			pkg.Deb.URL = newurl
+		}
+
+		// TODO use faketime on old releases?
+		pkg.Deb.URL = strings.Replace(pkg.Deb.URL, "https", "http", -1)
+
+		cmds = append(cmds, "wget --no-check-certificate "+pkg.Deb.URL)
+	}
+
+	cmds = append(cmds, "dpkg -i ./*.deb")
+
+	return
+}
+
+func CleanupFailed(km config.KernelMask, pkgname string) {
+	pkgdir := config.Dir(filepath.Join("volumes", km.DockerName(), pkgname))
+
+	log.Debug().Msgf("cleanup %s", pkgdir)
+
+	err := os.RemoveAll(pkgdir)
+	if err != nil {
+		log.Warn().Err(err).Msg("cleanup")
+	}
+}
diff --git a/distro/debian/kernel.go b/distro/debian/kernel.go
index 17cd104..9a1d54d 100644
--- a/distro/debian/kernel.go
+++ b/distro/debian/kernel.go
@@ -122,7 +122,7 @@ func getDebianKernel(version string) (dk DebianKernel, err error) {
 }
 
 // GetCachedKernel by deb package name
-func GetCachedKernel(deb string) (dk DebianKernel, err error) {
+func getCachedKernel(deb string) (dk DebianKernel, err error) {
 	c, err := NewCache(CachePath)
 	if err != nil {
 		log.Error().Err(err).Msg("cache")
diff --git a/kernel/kernel.go b/kernel/kernel.go
index 09fc8fe..59859c6 100644
--- a/kernel/kernel.go
+++ b/kernel/kernel.go
@@ -25,7 +25,6 @@ import (
 	"code.dumpstack.io/tools/out-of-tree/config"
 	"code.dumpstack.io/tools/out-of-tree/container"
 	"code.dumpstack.io/tools/out-of-tree/distro/debian"
-	"code.dumpstack.io/tools/out-of-tree/distro/debian/snapshot"
 	"code.dumpstack.io/tools/out-of-tree/fs"
 )
 
@@ -406,35 +405,20 @@ func installKernel(sk config.KernelMask, pkgname string, force, headers bool) (e
 				"/boot/initramfs-%s.img %s", version, version)
 		}
 	case config.Debian:
-		// TODO move to distro/debian/
-
-		var dk debian.DebianKernel
-		dk, err = debian.GetCachedKernel(pkgname + ".deb")
+		var commands []string
+		commands, err = debian.InstallCommands(sk, pkgname)
 		if err != nil {
 			return
 		}
-
-		pkgs := []snapshot.Package{dk.Image}
-		if headers {
-			pkgs = append(pkgs, dk.Headers...)
-			pkgs = append(pkgs, dk.Dependencies...)
-		}
-
-		for _, pkg := range pkgs {
-			found, newurl := cache.PackageURL(
-				sk.DistroType,
-				pkg.Deb.URL,
-			)
-			if found {
-				log.Debug().Msgf("cached deb found %s", newurl)
-				pkg.Deb.URL = newurl
+		defer func() {
+			if err != nil {
+				debian.CleanupFailed(sk, pkgname)
 			}
+		}()
 
-			cmd += fmt.Sprintf(" && wget --no-check-certificate %s",
-				strings.Replace(pkg.Deb.URL, "https", "http", -1))
+		for _, command := range commands {
+			cmd += fmt.Sprintf(" && %s", command)
 		}
-
-		cmd += fmt.Sprintf(" && dpkg -i ./*deb ; apt-get -fy install")
 	default:
 		err = fmt.Errorf("%s not yet supported", sk.DistroType.String())
 		return