StageX
Hacker ApprovedThe most recommended of 5 container base images
Reproducible, source-bootstrapped container base images and Linux distribution with multi-party signed builds for strict supply chain threat models, though critics say collecting upstream sources is the biggest pain point.
Reproducible, source-bootstrapped container base images and Linux distribution with multi-party signed builds for strict supply chain threat models, though critics say collecting upstream sources is the biggest pain point.
17 people gave an opinion
- recommend it
- 12
- criticize it
- 5
- approval share
- 71%
Recommended in 10 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 12 people recommend itNeeds 10 or more, met.
- 2.4 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 10 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Full source bootstrapping from minimal binary
“Stagex has a 100% full source bootstrapping, and reproducibility requirement that at least two maintainers must prove and sign for every package.”
Comment from 2 Nov 2025 in “GHC now runs in the browser” “We full source bootstrapped our 100% deterministic, quorum-signed, LLVM/musl native, and container native distribution this way from day 1”
Comment from 28 Aug 2026 in “Bootstrappable Builds: How and Why” “I bootstrapped a new generation of Linux distribution from 180 bytes of human readable x86 machine code all the way up.”
Comment from 5 May 2026 in “I am worried about Bun” - Comment from 16 Nov 2025 in “Running the "Reflections on Trusting Trust" Compiler (2023)”
- Comment from 10 May 2026 in “Debian must ship reproducible packages”
- Comment from 8 Aug 2026 in “The Nixpkgs core team has disbanded”
- Comment from 2 Nov 2025 in “GHC now runs in the browser”
- Comment from 13 Apr 2026 in “Just Enough Chimera Linux”
Reproducible, deterministic builds
“every single release is signed by a quorum of code reviewers and code reproducers that must all build locally and get identical hashes”
Comment from 31 Mar 2026 in “Claude Code's source code has been leaked via a map file in their NPM registry” “stagex was the first to hit 100% full source bootstrapped deterministic and hermetic builds last year”
Comment from 10 May 2026 in “Debian must ship reproducible packages” “StageX does reproducible builds, so they are signed independently and can also be verified locally.”
Comment from 9 Apr 2026 in “Open Source Security at Astral” - Comment from 13 Apr 2026 in “Just Enough Chimera Linux”
- Comment from 11 Aug 2026 in “Illinois Just Passed a Law That Puts Linux on the Hook for Age Verification”
- Comment from 13 Dec 2025 in “Building small Docker images faster”
Multi-party signed releases, no single maintainer
“It is not possible for any single person to release anything. We require multiple independent review and reproduction signatures from the maintainer team.”
Comment from 9 Jul 2026 in “OpenMandriva: Statement regarding attempted distribution sabotage” “every single release is signed by a quorum of code reviewers and code reproducers that must all build locally and get identical hashes”
Comment from 31 Mar 2026 in “Claude Code's source code has been leaked via a map file in their NPM registry” “None of the alternatives come anywhere close to what we needed to satisfy a threat model that trusts no single maintainer or computer”
Comment from 18 Dec 2025 in “A Safer Container Ecosystem with Docker: Free Docker Hardened Images” - Comment from 24 Dec 2025 in “Towards a secure peer-to-peer app platform for Clan”
- Comment from 13 Dec 2025 in “Building small Docker images faster”
Container native, usable as Docker base
“since StageX is distributed as OCI images, you could just replace your existing Dockerfile bases with stagex”
Comment from 9 Apr 2026 in “Open Source Security at Astral” “our images are actually container native meaning they are "from scratch" all the way down”
Comment from 19 Dec 2025 in “A Safer Container Ecosystem with Docker: Free Docker Hardened Images”
What people warn about
Each mark is one comment
Overconfident claims, source not read
“Your level of certainty is the thing that frightens me more than the confidence I have in the quality of your work.”
Comment from 31 Mar 2026 in “Claude Code's source code has been leaked via a map file in their NPM registry” “I'm guessing even they haven't read through all that source code though.”
Comment from 19 May 2026 in “We stopped AI bot spam in our GitHub repo using Git's –author flag” Size and codebase claims questioned
“I don't understand how your tool could possibly produce "even smaller images"”
Comment from 13 Dec 2025 in “Building small Docker images faster” “That distro has smaller codebase than Debian Installer.”
Comment from 10 May 2026 in “Debian must ship reproducible packages” Doubts value of signed commits
“how would you compare the downgrade in security due to less code auditing vs the reassurance of reproducible builds?”
Comment from 3 Nov 2025 in “GHC now runs in the browser” “So I’m very murky on the value of signed package commits that come from a different set of identities”
Comment from 9 Apr 2026 in “Open Source Security at Astral”
Other container base images people recommend
The four most recommended other container base images, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| StageXThis page | 12 | 5 | 71% | 10 | — | Approved |
| Docker Hardened Images | 11 | 14 | 44% | 4 | — | — |
| Chainguard Images | 9 | 25 | 26% | 4 | — | — |
| Minimus container images | 6 | 10 | 38% | 3 | — | — |
| Distroless container images | 5 | 0 | 100% | 3 | — | — |
What people said
40 of the 58 comments that mention it, newest first. Each links to the original comment.
“how stagex compromises of all of these stages to finally build a whole distro”
“Stagex actually does every single thing I am recommending Homebrew do, and with a way smaller team.”
“protecting hundreds of billions of dollars in fintech infrastructure right now”
“We full source bootstrapped our 100% deterministic, quorum-signed, LLVM/musl native, and container native distribution this way from day 1”
“it is the only fully deterministic and multi-party verifiable OS stack that exists”
“the security and portability wins of sticking to standards with many existing implementations”
“You can define an immutable, deterministic, and bootable system image for anything from an enclave to a laptop”
“full source bootstrapped, multi-party-signed, container native, and deterministic alternative to nix”
“It is not possible for any single person to release anything. We require multiple independent review and reproduction signatures from the maintainer team.”
“I'm guessing even they haven't read through all that source code though.”
“That distro has smaller codebase than Debian Installer.”
“stagex was the first to hit 100% full source bootstrapped deterministic and hermetic builds last year”
“I bootstrapped a new generation of Linux distribution from 180 bytes of human readable x86 machine code all the way up.”
“Nice! I'd thought about doing something similar, but never went so far as to get where y'all are at!”
“full source bootstrapping, 100% deterministic builds, and multi-party-signed artifacts”
“They would need to be using something like heavily customized buildroot or stagex”
“We cache a copy of all 5444 keys in the web of trust of stagex maintainers in our keys repo”
“Except for things built on stagex, in which case you would have to compromise several.”
“since StageX is distributed as OCI images, you could just replace your existing Dockerfile bases with stagex”
“we can prove we faithfully deliver honest compilations of whatever upstream code is published without any single points of failure.”
“StageX does reproducible builds, so they are signed independently and can also be verified locally.”
“So I’m very murky on the value of signed package commits that come from a different set of identities”
“The only binaries of uv in the world you can get that were full source bootstrapped from signed package commits”
“when combined with the other tactics in stagex I believe it gives us a very strong supply chain attack defense”
“Your level of certainty is the thing that frightens me more than the confidence I have in the quality of your work.”
“every single release is signed by a quorum of code reviewers and code reproducers that must all build locally and get identical hashes”
“no previous Linux distribution has a decentralized trust story appropriate for production use hosting public internet services”
“Stagex is a remarkable achievement and one of the most exciting projects that I have encountered this year.”
“every commit signed by one maintainer, and every review/merge signed by a different maintainer”
“which I founded specifically because nix did not wish to adopt a strict threat model”
“our images are actually container native meaning they are "from scratch" all the way down”
“None of the alternatives come anywhere close to what we needed to satisfy a threat model that trusts no single maintainer or computer”
“I don't understand how your tool could possibly produce "even smaller images"”
“always deterministic/reproducible with a multi-party signed supply chain”
“so far only GNU Guix and StageX have worked out how to start from the BB work to get a full distro”
“the first software build toolchain that internally mandates 100% determinism and full source bootstrapping”
“how would you compare the downgrade in security due to less code auditing vs the reassurance of reproducible builds?”
“We bootstrap everything deterministically from 180 bytes of human auditable x86 machine code.”
“Stagex has a 100% full source bootstrapping, and reproducibility requirement that at least two maintainers must prove and sign for every package.”
“Stagex goes much further in that it has a 100% mandate on supply chain integrity”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.