diff --git a/Dockerfile.base b/Dockerfile.base
new file mode 100644
index 0000000..55974ee
--- /dev/null
+++ b/Dockerfile.base
@@ -0,0 +1,3 @@
+FROM scratch
+ADD rootfs.tar.gz /
+CMD ["/bin/bash", "-l"]
diff --git a/Dockerfile.rootfs b/Dockerfile.rootfs
new file mode 100644
index 0000000..36de544
--- /dev/null
+++ b/Dockerfile.rootfs
@@ -0,0 +1,10 @@
+## This ought to be bootstrapable with docker.io/debian as well
+ARG IMAGENAME=r.thisco.de/debian
+ARG IMAGETAG=latest
+ARG VERSION=bullseye
+
+FROM ${IMAGENAME}:${IMAGETAG} AS build
+ADD build-rootfs.sh /
+ENV VERS=${VERSION}
+RUN bash build-rootfs.sh
+
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..bc4cf97
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,36 @@
+
+FROM_IMAGE_NAME	:= r.thisco.de/debian
+FROM_IMAGE_TAG	:= latest
+VERSION		:= bullseye
+
+BASE_ROOTFS	:= base-rootfs
+BASE_TMP	:= base-rootfs-tmp
+BASE_IMAGE_NAME	:= r.thisco.de/debian
+BASE_IMAGE_TAG	:= $(VERSION)
+
+default: base
+
+.PHONY: rootfs.tar.gz
+
+rootfs.tar.gz: Dockerfile.rootfs build-rootfs.sh
+	docker build --build-arg "IMAGENAME=$(FROM_IMAGE_NAME)" --build-arg "IMAGETAG=$(FROM_IMAGE_TAG)" --build-arg "VERSION=$(VERSION)" -t "$(BASE_ROOTFS)" -f Dockerfile.rootfs . && \
+	docker create --name=$(BASE_TMP) "$(BASE_ROOTFS)" && \
+	docker cp $(BASE_TMP):/rootfs.tar.gz . && \
+	docker rm -f $(BASE_TMP)
+
+.PHONY: base
+
+base: rootfs.tar.gz Dockerfile.base
+	docker build -t $(BASE_IMAGE_NAME) -f Dockerfile.base . && \
+	docker run -it --rm $(BASE_IMAGE_NAME) echo success && \
+	docker tag $(BASE_IMAGE_NAME) $(BASE_IMAGE_NAME):$(BASE_IMAGE_TAG)
+
+.PHONY: push
+push: base
+	docker push $(BASE_IMAGE_NAME) && \
+	docker push $(BASE_IMAGE_NAME):$(BASE_IMAGE_TAG)
+
+clean:
+	rm -f rootfs.tar.gz && \
+	docker rmi $(BASE_ROOTFS)
+
diff --git a/build-rootfs.sh b/build-rootfs.sh
new file mode 100644
index 0000000..8538eba
--- /dev/null
+++ b/build-rootfs.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+set -eu
+
+VERS="${VERS:-bullseye}"
+CACHEDIR="${CACHEDIR:-/cache}"
+DESTDIR="${DESTDIR:-.}"
+ROOTFS="${ROOTFS:-./rootfs}"
+
+# in case the user passes a relative path
+CACHEDIR="$(realpath ${CACHEDIR})"
+
+apt update -y
+apt install -y debootstrap
+
+rm -rf "${ROOTFS}"
+mkdir -p "${CACHEDIR}"
+
+debootstrap --variant=minbase --cache-dir="${CACHEDIR}" "${VERS}" "${ROOTFS}"
+
+cat > "${ROOTFS}/etc/apt/source.list" <<EOM
+deb http://deb.debian.org/debian ${VERS} main contrib non-free
+deb http://deb.debian.org/debian ${VERS}-updates main contrib non-free
+deb http://security.debian.org/debian-security ${VERS}-security main contrib non-free
+deb http://ftp.debian.org/debian ${VERS}-backports main contrib non-free
+#deb-src http://deb.debian.org/debian ${VERS} main contrib
+#deb-src http://deb.debian.org/debian ${VERS}-updates main contrib
+#deb-src http://security.debian.org/debian-security ${VERS}-security main contrib
+#deb-src http://ftp.debian.org/debian ${VERS}-backports main contrib
+EOM
+
+rm -rf "${ROOTFS}"/usr/share/doc/*
+# we need to keep copyright files for legal reasons
+#path-include /usr/share/doc/*/copyright
+rm -rf "${ROOTFS}"/usr/share/man/*
+rm -rf "${ROOTFS}"/usr/share/groff/*
+rm -rf "${ROOTFS}"/usr/share/info/*
+# lintian stuff is small, but really unnecessary
+rm -rf "${ROOTFS}"/usr/share/lintian/*
+rm -rf "${ROOTFS}"/usr/share/linda/*
+rm -rf "${ROOTFS}"/var/cache/apt/archives/*
+rm -rf "${ROOTFS}"/var/lib/apt/lists/*
+
+tar -zcvf "${DESTDIR}/rootfs.tar.gz" -C "${ROOTFS}" .
+