diff --git a/drone/agent/exec.go b/drone/agent/exec.go
index b0ded68f4..8ca91bb2c 100644
--- a/drone/agent/exec.go
+++ b/drone/agent/exec.go
@@ -66,27 +66,23 @@ func (r *pipeline) run() error {
 		secrets = append(secrets, &model.Secret{
 			Name:   "DRONE_NETRC_USERNAME",
 			Value:  w.Netrc.Login,
-			Images: r.config.netrc, // TODO(bradrydzewski) use the command line parameters here
-			Events: []string{model.EventDeploy, model.EventPull, model.EventPush, model.EventTag},
+			Images: []string{"*"},
+			Events: []string{"*"},
 		})
 		secrets = append(secrets, &model.Secret{
 			Name:   "DRONE_NETRC_PASSWORD",
 			Value:  w.Netrc.Password,
-			Images: r.config.netrc,
-			Events: []string{model.EventDeploy, model.EventPull, model.EventPush, model.EventTag},
+			Images: []string{"*"},
+			Events: []string{"*"},
 		})
 		secrets = append(secrets, &model.Secret{
 			Name:   "DRONE_NETRC_MACHINE",
 			Value:  w.Netrc.Machine,
-			Images: r.config.netrc,
-			Events: []string{model.EventDeploy, model.EventPull, model.EventPush, model.EventTag},
+			Images: []string{"*"},
+			Events: []string{"*"},
 		})
 	}
 
-	for _, secret := range secrets {
-		fmt.Printf("SECRET %s %s\n", secret.Name, secret.Value)
-	}
-
 	trans := []compiler.Transform{
 		builtin.NewCloneOp("git", true),
 		builtin.NewCacheOp(
diff --git a/engine/compiler/builtin/pod.go b/engine/compiler/builtin/pod.go
index 630b353cb..791c2a6fd 100644
--- a/engine/compiler/builtin/pod.go
+++ b/engine/compiler/builtin/pod.go
@@ -34,7 +34,7 @@ func (v *podOp) VisitRoot(node *parse.RootNode) error {
 	service.Container = runner.Container{
 		Name:       v.name,
 		Alias:      "ambassador",
-		Image:      "busybox",
+		Image:      "busybox:latest",
 		Entrypoint: []string{"/bin/sleep"},
 		Command:    []string{"86400"},
 		Volumes:    []string{node.Path, node.Base},
diff --git a/engine/compiler/builtin/shell.go b/engine/compiler/builtin/shell.go
index 3ad3d004d..a3dd32068 100644
--- a/engine/compiler/builtin/shell.go
+++ b/engine/compiler/builtin/shell.go
@@ -36,14 +36,14 @@ func (v *shellOp) VisitContainer(node *parse.ContainerNode) error {
 		"/bin/sh", "-c",
 	}
 	node.Container.Command = []string{
-		"echo $CI_CMDS | base64 -d | /bin/sh -e",
+		"echo $DRONE_SCRIPT | base64 -d | /bin/sh -e",
 	}
 	if node.Container.Environment == nil {
 		node.Container.Environment = map[string]string{}
 	}
 	node.Container.Environment["HOME"] = "/root"
 	node.Container.Environment["SHELL"] = "/bin/sh"
-	node.Container.Environment["CI_CMDS"] = toScript(
+	node.Container.Environment["DRONE_SCRIPT"] = toScript(
 		node.Root().Path,
 		node.Commands,
 	)
@@ -72,7 +72,17 @@ func toScript(base string, commands []string) string {
 // setupScript is a helper script this is added to the build to ensure
 // a minimum set of environment variables are set correctly.
 const setupScript = `
-echo $DRONE_NETRC > $HOME/.netrc
+if [ -n "$DRONE_NETRC_MACHINE" ]; then
+cat <<EOF > $HOME/.netrc
+machine $DRONE_NETRC_MACHINE
+login $DRONE_NETRC_USERNAME
+password $DRONE_NETRC_PASSWORD
+EOF
+fi
+
+unset DRONE_NETRC_USERNAME
+unset DRONE_NETRC_PASSWORD
+unset DRONE_SCRIPT
 
 %s
 `
diff --git a/engine/compiler/builtin/shell_test.go b/engine/compiler/builtin/shell_test.go
index f771a8dfd..bc9dd8291 100644
--- a/engine/compiler/builtin/shell_test.go
+++ b/engine/compiler/builtin/shell_test.go
@@ -23,7 +23,7 @@ func Test_shell(t *testing.T) {
 
 			g.Assert(len(c.Container.Entrypoint)).Equal(0)
 			g.Assert(len(c.Container.Command)).Equal(0)
-			g.Assert(c.Container.Environment["CI_CMDS"]).Equal("")
+			g.Assert(c.Container.Environment["DRONE_SCRIPT"]).Equal("")
 		})
 
 		g.It("should set entrypoint, command and environment variables", func() {
@@ -37,8 +37,8 @@ func Test_shell(t *testing.T) {
 			ops.VisitContainer(c)
 
 			g.Assert(c.Container.Entrypoint).Equal([]string{"/bin/sh", "-c"})
-			g.Assert(c.Container.Command).Equal([]string{"echo $CI_CMDS | base64 -d | /bin/sh -e"})
-			g.Assert(c.Container.Environment["CI_CMDS"] != "").IsTrue()
+			g.Assert(c.Container.Command).Equal([]string{"echo $DRONE_SCRIPT | base64 -d | /bin/sh -e"})
+			g.Assert(c.Container.Environment["DRONE_SCRIPT"] != "").IsTrue()
 		})
 	})
 }
diff --git a/model/secret.go b/model/secret.go
index c22e7ca54..767299a5c 100644
--- a/model/secret.go
+++ b/model/secret.go
@@ -34,6 +34,8 @@ func (s *Secret) MatchImage(image string) bool {
 	for _, pattern := range s.Images {
 		if match, _ := filepath.Match(pattern, image); match {
 			return true
+		} else if pattern == "*" {
+			return true
 		}
 	}
 	return false
diff --git a/model/secret_test.go b/model/secret_test.go
index eec2b560f..1a31a2bd2 100644
--- a/model/secret_test.go
+++ b/model/secret_test.go
@@ -29,7 +29,7 @@ func TestSecret(t *testing.T) {
 		g.It("should match any image", func() {
 			secret := Secret{}
 			secret.Images = []string{"*"}
-			g.Assert(secret.MatchImage("golang")).IsTrue()
+			g.Assert(secret.MatchImage("custom/golang")).IsTrue()
 		})
 		g.It("should match any event", func() {
 			secret := Secret{}