diff --git a/config/out-of-tree.go b/config/out-of-tree.go
index 175874b..a4e2b4a 100644
--- a/config/out-of-tree.go
+++ b/config/out-of-tree.go
@@ -35,9 +35,12 @@ type OutOfTree struct {
 		Timeout  artifact.Duration
 		Registry string
 
-		// Commands that will be executed before
-		// the base layer of Dockerfile
-		Commands []distro.Command
+		// Commands that are executed before (prepend) and after (append) the
+		// base layer of the Dockerfile.
+		Commands struct {
+			Prepend []distro.Command
+			Append  []distro.Command
+		}
 	}
 }
 
diff --git a/container/container.go b/container/container.go
index fd479f2..e358820 100644
--- a/container/container.go
+++ b/container/container.go
@@ -32,7 +32,12 @@ var Registry = ""
 
 var Timeout time.Duration
 
-var Commands []distro.Command
+// Commands that are executed before (prepend) and after (append) the
+// base layer of the Dockerfile.
+var Commands struct {
+	Prepend []distro.Command
+	Append  []distro.Command
+}
 
 var UseCache = true
 
@@ -296,9 +301,15 @@ func (c Container) Build(image string, envs, runs []string) (err error) {
 	}
 	cf += image + "\n"
 
-	for _, c := range Commands {
-		// TODO check for distro type
-		cf += "RUN " + c.Command + "\n"
+	for _, cmd := range Commands.Prepend {
+		if cmd.Distro.ID != distro.None && cmd.Distro.ID != c.dist.ID {
+			continue
+		}
+		if cmd.Distro.Release != "" && cmd.Distro.Release != c.dist.Release {
+			continue
+		}
+
+		cf += "RUN " + cmd.Command + "\n"
 	}
 
 	for _, e := range envs {
@@ -309,6 +320,17 @@ func (c Container) Build(image string, envs, runs []string) (err error) {
 		cf += "RUN " + c + "\n"
 	}
 
+	for _, cmd := range Commands.Append {
+		if cmd.Distro.ID != distro.None && cmd.Distro.ID != c.dist.ID {
+			continue
+		}
+		if cmd.Distro.Release != "" && cmd.Distro.Release != c.dist.Release {
+			continue
+		}
+
+		cf += "RUN " + cmd.Command + "\n"
+	}
+
 	buf, err := os.ReadFile(cfile)
 	if err != nil {
 		err = os.WriteFile(cfile, []byte(cf), os.ModePerm)