diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,8 @@
+## 0.5.1
+
+* `loadBuildConstraints`
+* More command line options
+
 ## 0.5.0
 
 * Print "Still Alive" while checking, to avoid Travis timeouts
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -49,6 +49,28 @@
     cabal install stackage
     stackage nightly
 
+### Docker
+
+Note: This method is currently considered experimental.
+
+If you'd like to check a build plan, or perform an entire build, without
+specially configuring your system, Docker may be a good approach. To check if
+some modifications to `build-constraints.yaml` are valid, try the following:
+
+1. Create a local clone of the `stackage` repo
+2. Make modifications to your local `build-constraints.yaml`
+3. Inside the `stackage` working directory, run the following:
+
+   ```
+   $ docker run -it --rm -v $(pwd):/stackage -w /stackage snoyberg/stackage /bin/bash -c 'cabal update && stackage check'
+   ```
+
+Similarly, if you'd like to perform an entire build, you can replace the last step with:
+
+```
+$ docker run -it --rm -v $(pwd):/stackage -w /stackage snoyberg/stackage /bin/bash -c 'cabal update && stackage build --skip-upload'
+```
+
 ## Processing
 
 The following describes at a high level the series of steps for processing
diff --git a/Stackage/BuildConstraints.hs b/Stackage/BuildConstraints.hs
--- a/Stackage/BuildConstraints.hs
+++ b/Stackage/BuildConstraints.hs
@@ -11,6 +11,8 @@
     , getSystemInfo
     , defaultBuildConstraints
     , toBC
+    , BuildConstraintsSource (..)
+    , loadBuildConstraints
     ) where
 
 import           Control.Monad.Writer.Strict (execWriter, tell)
@@ -22,7 +24,7 @@
 import qualified Distribution.System
 import           Distribution.Version        (anyVersion)
 import           Filesystem                  (isFile)
-import           Network.HTTP.Client         (Manager, httpLbs, responseBody)
+import           Network.HTTP.Client         (Manager, httpLbs, responseBody, Request)
 import           Stackage.CorePackages
 import           Stackage.Prelude
 
@@ -126,15 +128,32 @@
 -- Checks the current directory for a build-constraints.yaml file and uses it
 -- if present. If not, downloads from Github.
 defaultBuildConstraints :: Manager -> IO BuildConstraints
-defaultBuildConstraints man = do
-    e <- isFile fp
-    if e
-        then decodeFileEither (fpToString fp) >>= either throwIO toBC
-        else httpLbs req man >>=
-             either throwIO toBC . decodeEither' . toStrict . responseBody
+defaultBuildConstraints = loadBuildConstraints BCSDefault
+
+data BuildConstraintsSource
+    = BCSDefault
+    | BCSFile FilePath
+    | BCSWeb Request
+    deriving (Show)
+
+loadBuildConstraints :: BuildConstraintsSource -> Manager -> IO BuildConstraints
+loadBuildConstraints bcs man = do
+    case bcs of
+        BCSDefault -> do
+            e <- isFile fp0
+            if e
+                then loadFile fp0
+                else loadReq req0
+        BCSFile fp -> loadFile fp
+        BCSWeb req -> loadReq req
   where
-    fp = "build-constraints.yaml"
-    req = "https://raw.githubusercontent.com/fpco/stackage/master/build-constraints.yaml"
+    fp0 = "build-constraints.yaml"
+    req0 = "https://raw.githubusercontent.com/fpco/stackage/master/build-constraints.yaml"
+
+    loadFile fp = decodeFileEither (fpToString fp) >>= either throwIO toBC
+    loadReq req = httpLbs req man >>=
+                  either throwIO toBC . decodeEither' . toStrict . responseBody
+
 
 getSystemInfo :: IO SystemInfo
 getSystemInfo = do
diff --git a/Stackage/CompleteBuild.hs b/Stackage/CompleteBuild.hs
--- a/Stackage/CompleteBuild.hs
+++ b/Stackage/CompleteBuild.hs
@@ -27,6 +27,7 @@
 import Stackage.ServerBundle
 import Stackage.UpdateBuildPlan
 import Stackage.Upload
+import System.Environment        (lookupEnv)
 import System.IO                 (BufferMode (LineBuffering), hSetBuffering)
 
 -- | Flags passed in from the command line.
@@ -241,12 +242,18 @@
 finallyUpload :: Settings -> Manager -> IO ()
 finallyUpload settings@Settings{..} man = do
     putStrLn "Uploading bundle to Stackage Server"
-    token <- readFile "/auth-token"
+
+    mtoken <- lookupEnv "STACKAGE_AUTH_TOKEN"
+    token <-
+        case mtoken of
+            Nothing -> decodeUtf8 <$> readFile "/auth-token"
+            Just token -> return $ pack token
+
     now <- epochTime
     let ghcVer = display $ siGhcVersion $ bpSystemInfo plan
     (ident, mloc) <- flip uploadBundle man $ setArgs ghcVer def
         { ubContents = serverBundle now (title ghcVer) slug plan
-        , ubAuthToken = decodeUtf8 token
+        , ubAuthToken = token
         }
     putStrLn $ "New ident: " ++ unSnapshotIdent ident
     forM_ mloc $ \loc ->
@@ -257,7 +264,7 @@
     putStrLn "Uploading docs to Stackage Server"
     res1 <- uploadDocs UploadDocs
         { udServer = def
-        , udAuthToken = decodeUtf8 token
+        , udAuthToken = token
         , udDocs = pbDocDir pb
         , udSnapshot = ident
         } man
@@ -274,7 +281,7 @@
     putStrLn "Uploading doc map"
     uploadDocMap UploadDocMap
         { udmServer = def
-        , udmAuthToken = decodeUtf8 token
+        , udmAuthToken = token
         , udmSnapshot = ident
         , udmDocDir = pbDocDir pb
         , udmPlan = plan
diff --git a/Stackage/PerformBuild.hs b/Stackage/PerformBuild.hs
--- a/Stackage/PerformBuild.hs
+++ b/Stackage/PerformBuild.hs
@@ -197,7 +197,7 @@
             id
             (\db -> (("HASKELL_PACKAGE_SANDBOX", fpToString db):))
             (pbDatabase pb)
-            (map fixEnv env)
+            (filter allowedEnv $ map fixEnv env)
         , sbHaddockFiles = haddockFiles
         }
 
@@ -215,6 +215,8 @@
         | toUpper p == "PATH" = (p, fpToString (pbBinDir pb) ++ pathSep : x)
         | otherwise = (p, x)
 
+    allowedEnv (k, _) = k `notMember` bannedEnvs
+
     -- | Separate for the PATH environment variable
     pathSep :: Char
 #ifdef mingw32_HOST_OS
@@ -222,6 +224,12 @@
 #else
     pathSep = ':'
 #endif
+
+-- | Environment variables we don't allow to be passed on to child processes.
+bannedEnvs :: Set String
+bannedEnvs = setFromList
+    [ "STACKAGE_AUTH_TOKEN"
+    ]
 
 data SingleBuild = SingleBuild
     { sbSem           :: TSem
diff --git a/stackage.cabal b/stackage.cabal
--- a/stackage.cabal
+++ b/stackage.cabal
@@ -1,5 +1,5 @@
 name:                stackage
-version:             0.5.0
+version:             0.5.1
 synopsis:            "Stable Hackage," tools for creating a vetted set of packages from Hackage.
 description:         Please see <http://www.stackage.org/package/stackage> for a description and documentation.
 homepage:            https://github.com/fpco/stackage
@@ -12,6 +12,7 @@
 cabal-version:       >=1.10
 extra-source-files:  README.md
                      ChangeLog.md
+                     test/test-build-constraints.yaml
 
 library
   default-language:    Haskell2010
diff --git a/test/test-build-constraints.yaml b/test/test-build-constraints.yaml
new file mode 100644
--- /dev/null
+++ b/test/test-build-constraints.yaml
@@ -0,0 +1,20 @@
+packages:
+    "Test":
+       - foo
+       - bar
+
+global-flags: []
+
+skipped-tests: []
+expected-test-failures: []
+expected-haddock-failures: []
+skipped-benchmarks: []
+skipped-profiling: []
+
+github-users:
+  bar:
+    - demo
+
+package-flags:
+  foo:
+    demo: true
