diff --git a/europa-universe/docker/image.cue b/europa-universe/docker/image.cue
new file mode 100644
index 00000000..472fe5e4
--- /dev/null
+++ b/europa-universe/docker/image.cue
@@ -0,0 +1,24 @@
+package docker
+
+import (
+	"dagger.io/dagger"
+	"dagger.io/dagger/engine"
+)
+
+// A container image
+#Image: {
+	// Root filesystem of the image.
+	rootfs: dagger.#FS
+
+	// Image config
+	config: engine.#ImageConfig
+}
+
+// A ref is an address for a remote container image
+// Examples:
+//   - "index.docker.io/dagger"
+//   - "dagger"
+//   - "index.docker.io/dagger:latest"
+//   - "index.docker.io/dagger:latest@sha256:a89cb097693dd354de598d279c304a1c73ee550fbfff6d9ee515568e0c749cfe"
+// FIXME: add formatting constraints
+#Ref: engine.#Ref
diff --git a/europa-universe/docker/pull.cue b/europa-universe/docker/pull.cue
new file mode 100644
index 00000000..b670f414
--- /dev/null
+++ b/europa-universe/docker/pull.cue
@@ -0,0 +1,37 @@
+// Build, ship and run Docker containers in Dagger
+package docker
+
+import (
+	"dagger.io/dagger/engine"
+	"dagger.io/dagger"
+)
+
+// Download an image from a remote registry
+#Pull: {
+	// Source ref.
+	source: #Ref
+
+	// Registry authentication
+	// Key must be registry address, for example "index.docker.io"
+	auth: [registry=string]: {
+		username: string
+		secret:   dagger.#Secret
+	}
+
+	_op: engine.#Pull & {
+		"source": source
+		"auth": [ for target, creds in auth {
+			"target": target
+			creds
+		}]
+	}
+
+	// Downloaded image
+	image: #Image & {
+		rootfs: _op.output
+		config: _op.config
+	}
+
+	// FIXME: compat with Build API
+	output: image
+}
diff --git a/europa-universe/docker/push.cue b/europa-universe/docker/push.cue
new file mode 100644
index 00000000..594007d3
--- /dev/null
+++ b/europa-universe/docker/push.cue
@@ -0,0 +1,31 @@
+package docker
+
+import (
+	"dagger.io/dagger"
+	"dagger.io/dagger/engine"
+)
+
+// Upload an image to a remote repository
+#Push: {
+	// Destination ref
+	dest: #Ref
+
+	// Complete ref after pushing (including digest)
+	result: #Ref & _push.result
+
+	// Registry authentication
+	// Key must be registry address
+	auth: [registry=string]: {
+		username: string
+		secret:   dagger.#Secret
+	}
+
+	// Image to push
+	image: #Image
+
+	_push: engine.#Push & {
+		dest:   dest
+		input:  image.rootfs
+		config: image.config
+	}
+}
diff --git a/europa-universe/docker/docker.cue b/europa-universe/docker/run.cue
similarity index 63%
rename from europa-universe/docker/docker.cue
rename to europa-universe/docker/run.cue
index 13d20a35..6decc348 100644
--- a/europa-universe/docker/docker.cue
+++ b/europa-universe/docker/run.cue
@@ -1,22 +1,12 @@
-// Build, ship and run Docker containers in Dagger
 package docker
 
 import (
 	"list"
 
-	"dagger.io/dagger/engine"
 	"dagger.io/dagger"
+	"dagger.io/dagger/engine"
 )
 
-// A container image
-#Image: {
-	// Root filesystem of the image.
-	rootfs: dagger.#FS
-
-	// Image config
-	config: engine.#ImageConfig
-}
-
 // Run a command in a container
 #Run: {
 	image: #Image
@@ -138,66 +128,3 @@ import (
 		"user":    user
 	}
 }
-
-// A ref is an address for a remote container image
-// Examples:
-//   - "index.docker.io/dagger"
-//   - "dagger"
-//   - "index.docker.io/dagger:latest"
-//   - "index.docker.io/dagger:latest@sha256:a89cb097693dd354de598d279c304a1c73ee550fbfff6d9ee515568e0c749cfe"
-#Ref: engine.#Ref
-
-// Download an image from a remote registry
-#Pull: {
-	// Source ref.
-	source: #Ref
-
-	// Registry authentication
-	// Key must be registry address, for example "index.docker.io"
-	auth: [registry=string]: {
-		username: string
-		secret:   dagger.#Secret
-	}
-
-	_op: engine.#Pull & {
-		"source": source
-		"auth": [ for target, creds in auth {
-			"target": target
-			creds
-		}]
-	}
-
-	// Downloaded image
-	image: #Image & {
-		rootfs: _op.output
-		config: _op.config
-	}
-
-	// FIXME: compat with Build API
-	output: image
-}
-
-// Upload an image to a remote repository
-#Push: {
-	// Destination ref
-	dest: #Ref
-
-	// Complete ref after pushing (including digest)
-	result: #Ref & _push.result
-
-	// Registry authentication
-	// Key must be registry address
-	auth: [registry=string]: {
-		username: string
-		secret:   dagger.#Secret
-	}
-
-	// Image to push
-	image: #Image
-
-	_push: engine.#Push & {
-		dest:   dest
-		input:  image.rootfs
-		config: image.config
-	}
-}