I have been looking into StageX a lot recently. I first came across it when looking into the build systems of Sidero Labs. StageX is a set of 100% reproducible OCI container images. This means it is all the way bootstrapped from zero (also called stage 0). Stage 0 is a small handcrafted binary of just 181 bytes. Everything after is built from source, bootstrapping from a pseudo assembler to a basic C compiler to older versions of GCC all the way up to a modern LLVM compiler. This is an interesting read about the process, but to fully grasp how insane it is I recommend firing up a Linux shell and manually bootstrapping stage 0.

I am planning to slowly convert all my projects to use the StageX base images, for example use their compilation of the Go compiler. And pinning all versions to a hash. And a big one that I learned from going through the source code is never again installing packages via apt inside a container build. This dooms your container build to be inconsistent. You should copy over the needed bin from another container image that has a pinned hash, like shown in the build of grep below. Everything that you pull from the internet inside a container build should be other containers. All this gave me a great new view on building container images.

FROM scratch AS build
ARG VERSION
COPY --from=stagex/core-busybox . /
COPY --from=stagex/core-musl . /
COPY --from=stagex/core-make . /
COPY --from=stagex/core-llvm . /
COPY --from=stagex/core-mold . /
COPY --from=stagex/core-onetbb . /
COPY --from=stagex/core-zlib . /
COPY --from=stagex/core-libzstd . /
ADD fetch/grep-${VERSION}.tar.xz .
WORKDIR /grep-${VERSION}
RUN --network=none <<-EOF
	set -ex
	./configure \
		--prefix=/usr \
		--sysconfdir=/etc \
		--mandir=/usr/share/man \
		--infodir=/usr/share/info \
		--disable-nls
	make -j "$(nproc)"
	make DESTDIR="/rootfs" install
EOF
FROM stagex/core-filesystem AS package
COPY --from=build /rootfs/ /