# StageX

12 Hacker News commenters recommended StageX and 5 criticized it, November 2025 to November 2026. It was recommended in 10 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Reproducible, source-bootstrapped container base images and Linux distribution with multi-party signed builds for strict supply chain threat models, though critics say collecting upstream sources is the biggest pain point.

## Why people recommend it

- Full source bootstrapping from minimal binary (8 comments): "Stagex has a 100% full source bootstrapping, and reproducibility requirement that at least two maintainers must prove and sign for every package." ([source](https://news.ycombinator.com/item?id=45789091)) "We full source bootstrapped our 100% deterministic, quorum-signed, LLVM/musl native, and container native distribution this way from day 1" ([source](https://news.ycombinator.com/item?id=49475284)) "I bootstrapped a new generation of Linux distribution from 180 bytes of human readable x86 machine code all the way up." ([source](https://news.ycombinator.com/item?id=48016687))
- Reproducible, deterministic builds (6 comments): "every single release is signed by a quorum of code reviewers and code reproducers that must all build locally and get identical hashes" ([source](https://news.ycombinator.com/item?id=47593831)) "stagex was the first to hit 100% full source bootstrapped deterministic and hermetic builds last year" ([source](https://news.ycombinator.com/item?id=48082467)) "StageX does reproducible builds, so they are signed independently and can also be verified locally." ([source](https://news.ycombinator.com/item?id=47704029))
- Multi-party signed releases, no single maintainer (5 comments): "It is not possible for any single person to release anything. We require multiple independent review and reproduction signatures from the maintainer team." ([source](https://news.ycombinator.com/item?id=48843226)) "every single release is signed by a quorum of code reviewers and code reproducers that must all build locally and get identical hashes" ([source](https://news.ycombinator.com/item?id=47593831)) "None of the alternatives come anywhere close to what we needed to satisfy a threat model that trusts no single maintainer or computer" ([source](https://news.ycombinator.com/item?id=46308322))
- Container native, usable as Docker base (2 comments): "since StageX is distributed as OCI images, you could just replace your existing Dockerfile bases with stagex" ([source](https://news.ycombinator.com/item?id=47708684)) "our images are actually container native meaning they are "from scratch" all the way down" ([source](https://news.ycombinator.com/item?id=46321349))

## What people warn about

- Overconfident claims, source not read (2 comments): "Your level of certainty is the thing that frightens me more than the confidence I have in the quality of your work." ([source](https://news.ycombinator.com/item?id=47594072)) "I'm guessing even they haven't read through all that source code though." ([source](https://news.ycombinator.com/item?id=48189790))
- Size and codebase claims questioned (2 comments): "I don't understand how your tool could possibly produce "even smaller images"" ([source](https://news.ycombinator.com/item?id=46251969)) "That distro has smaller codebase than Debian Installer." ([source](https://news.ycombinator.com/item?id=48082610))
- Doubts value of signed commits (2 comments): "how would you compare the downgrade in security due to less code auditing vs the reassurance of reproducible builds?" ([source](https://news.ycombinator.com/item?id=45796261)) "So I’m very murky on the value of signed package commits that come from a different set of identities" ([source](https://news.ycombinator.com/item?id=47703565))

## Alternatives hackers recommend

- [Docker Hardened Images](https://hackerapproved.com/p/docker-hardened-images.md): 11 recommend
- [Chainguard Images](https://hackerapproved.com/p/chainguard.md): 9 recommend
- [Minimus container images](https://hackerapproved.com/p/minimus-container-images.md): 6 recommend
- [Distroless container images](https://hackerapproved.com/p/distroless-container-images.md): 5 recommend

## Cite as

Hacker Approved, "StageX", https://hackerapproved.com/p/stagex/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).