Container

A minimal OCI base image: bash, CA certificates and pkg, with the Sandcastle repositories already configured, and no init.

It is glibc and bash rather than musl and busybox, so it is a small container without the musl and busybox problems that usually come with one. pkg install grows it into whatever you need, including inside the running container.

Get the manifest digest from the Download page.

Fetching it

It is published as an OCI image layout -- a directory -- rather than through a registry, so there is no podman pull from a URL. The build's own image.json lists every file in the layout, which makes fetching it a loop rather than a list of digests to copy by hand:

$ base=https://download.ur.foo-projects.org/image/Sandcastle/container-base/x86_64/2026.10
$ curl -fsSLO $base/image.json
$ jq -r '.files[].path | select(startswith("container-base/"))' image.json |
    while read -r f; do
      mkdir -p "$(dirname "$f")"
      curl -fsSL -o "$f" "$base/$f"
    done

Replace the version with the one you want. Every blob is named after its own SHA-256 and podman checks each one as it reads it, so there is no separate checksum step: what you verify is the manifest digest, against the one the Download page lists.

Running it

The tag in the layout is the version:

$ podman run --rm -it oci:$PWD/container-base:2026.10

Building on it

Pull it into podman's image store once and give it a name, and a Containerfile can then start FROM that name:

$ id=$(podman pull -q oci:$PWD/container-base:2026.10)
$ podman tag $id localhost/ur/container-base:2026.10
$ cat Containerfile
FROM localhost/ur/container-base:2026.10
RUN pkg --yes install vim
$ podman build -t my-image .