diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..41176064e
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,87 @@
+name: Build Sysbox Packages
+
+on:
+  push:
+    branches: [ "master", "main" ]
+  pull_request:
+    branches: [ "master", "main" ]
+  workflow_dispatch:
+
+jobs:
+  test:
+    name: Test Sysbox
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Show versions
+        run: |
+          echo "Docker"
+          docker --version
+          echo "uname"
+          uname -a
+
+      - name: Checkout repository and submodules
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Test Sysbox
+        run: |
+          (cd sysbox-mgr && git apply ../sysbox-mgr-dont-call-errorf.patch)
+          (cd sysbox-mgr && git apply ../sysbox-mgr.patch)
+          (cd sysbox-runc && git apply ../sysbox-runc.patch)
+          sudo apt update && sudo apt install -y apparmor-utils
+          sudo aa-complain fusermount3 # makes sense only in isolated environment, do not copy to bundles
+          make test
+
+  build:
+    name: Build Sysbox (DEB)
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Show versions
+        run: |
+          echo "Docker"
+          docker --version
+          echo "uname"
+          uname -a
+
+      - name: Checkout repository and submodules
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Build Sysbox
+        run: |
+          (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
+          (cd sysbox-pkgr && git apply ../changelog-converter.patch)
+          (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
+          (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
+          (cd sysbox-pkgr && git apply ../pkgr-apply-custom-changes.patch)
+          git config --global user.name "Unset"
+          (cd sysbox-pkgr && make sources/sysbox)
+          (cd sysbox-pkgr/sources/sysbox/sysbox-fs && git apply ../../../../sysbox-fs.patch)
+          (cd sysbox-pkgr && make sysbox-deb generic)
+
+      - name: Locate generated .deb packages
+        run: |
+          find . -type f -name "*.deb" -ls
+
+      - name: Info for deb artifacts
+        run: |
+          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
+
+      - name: Verify deb artifact versions
+        run: |
+          # Locate the package
+          DEB_FILE=$(ls sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb | head -n 1)
+
+          # 1. Unpack deb into a temporary directory
+          EXTRACT_DIR="./extracted_deb"
+          mkdir -p "$EXTRACT_DIR"
+          dpkg-deb --extract "$DEB_FILE" "$EXTRACT_DIR"
+
+          # 2. Run the apps with --version
+          "$EXTRACT_DIR/usr/bin/sysbox-fs" --version
+          "$EXTRACT_DIR/usr/bin/sysbox-runc" --version
+          "$EXTRACT_DIR/usr/bin/sysbox-mgr" --version
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..f0a1e0232
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,75 @@
+name: Release Sysbox
+
+on:
+  push:
+    tags:
+      - 'v*-test'
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Build Sysbox (DEB)
+    runs-on: ubuntu-26.04
+    steps:
+      - name: Show versions
+        run: |
+          echo "Docker"
+          docker --version
+          echo "uname"
+          uname -a
+
+      - name: Checkout repository and submodules
+        uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Verify release branch
+        run: |
+          echo "Verifying that tag '${{ github.ref_name }}' belongs to a release-* branch..."
+          git fetch --no-tags --depth=1 origin '+refs/heads/*:refs/remotes/origin/*'
+          
+          if ! git branch -r --contains HEAD | grep -E '^\s*origin/release-'; then
+            echo "::error::Tag '${{ github.ref_name }}' was not created on a branch prefixed with 'release-'."
+            echo "Branches containing this commit:"
+            git branch -r --contains HEAD
+            exit 1
+          fi
+          
+          echo "Tag '${{ github.ref_name }}' verified on a valid release branch."
+
+      - name: Build Sysbox
+        run: |
+          (cd sysbox-pkgr && git apply ../sysbox-pkgr.patch)
+          (cd sysbox-pkgr && git apply ../changelog-converter.patch)
+          (cd sysbox-pkgr && git apply ../trick-to-workarount-always-fail-setup.patch)
+          (cd sysbox-pkgr && git apply ../pkgr-copyright-and-license.patch)
+          (cd sysbox-pkgr && make sysbox-deb ubuntu-resolute)
+
+      - name: Locate generated .deb packages
+        run: |
+          find . -type f -name "*.deb" -ls
+
+      - name: Info for deb artifacts
+        run: |
+          dpkg --info sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb
+
+      - name: Generate deb checksum
+        run: |
+          mkdir -p release-assets
+          for pkg in sysbox-pkgr/deb/build/*/*/sysbox-ce_*.linux_*.deb; do
+            (cd "$(dirname "$pkg")" && sha256sum "$(basename "$pkg")") >> release-assets/SHA256SUMS
+          done
+          echo "Generated Checksums:"
+          cat release-assets/SHA256SUMS
+
+      - name: Create GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            release-assets/SHA256SUMS \
+            --title "${{ github.ref_name }}" \
+            --prerelease
\ No newline at end of file
diff --git a/.gitmodules b/.gitmodules
index a016477a4..6b3a2070a 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -6,16 +6,16 @@
 	url = ../sysbox-runc.git
 [submodule "sysbox-ipc"]
 	path = sysbox-ipc
-	url = ../sysbox-ipc.git
+	url = git@github.com:nestybox/sysbox-ipc
 [submodule "sysbox-mgr"]
 	path = sysbox-mgr
-	url = ../sysbox-mgr.git
+	url = git@github.com:nestybox/sysbox-mgr
 [submodule "sysbox-libs"]
 	path = sysbox-libs
-	url = ../sysbox-libs.git
+	url = git@github.com:nestybox/sysbox-libs
 [submodule "sysbox-pkgr"]
 	path = sysbox-pkgr
-	url = ../sysbox-pkgr.git
+	url = git@github.com:nestybox/sysbox-pkgr
 [submodule "sysbox-dockerfiles"]
 	path = sysbox-dockerfiles
-	url = ../dockerfiles.git
+	url = git@github.com:nestybox/dockerfiles
diff --git a/Makefile b/Makefile
index 39f47341e..63f73e71c 100644
--- a/Makefile
+++ b/Makefile
@@ -373,7 +373,7 @@ DOCKER_STOP := docker stop -t0 sysbox-test
 ##@ Testing targets
 
 test: ## Run all sysbox test suites
-test: test-fs test-mgr test-runc test-sysbox-libs test-sysbox test-sysbox-systemd
+test: test-fs test-mgr test-sysbox-libs test-sysbox test-sysbox-systemd
 
 test-sysbox: ## Run sysbox integration tests
 test-sysbox: test-prereq test-img
diff --git a/VERSION_OVERRIDE b/VERSION_OVERRIDE
new file mode 100644
index 000000000..288a7fb3e
--- /dev/null
+++ b/VERSION_OVERRIDE
@@ -0,0 +1 @@
+0.7.1-custom
\ No newline at end of file
diff --git a/changelog-converter.patch b/changelog-converter.patch
new file mode 100644
index 000000000..3c445267b
--- /dev/null
+++ b/changelog-converter.patch
@@ -0,0 +1,27 @@
+diff --git a/deb/changelog_convert.sh b/deb/changelog_convert.sh
+index 036bde0..b6e1f6d 100755
+--- a/deb/changelog_convert.sh
++++ b/deb/changelog_convert.sh
+@@ -95,19 +95,9 @@ function print_tag_trailer() {
+     local tag=$1
+     local unreleased=$2
+ 
+-    local tag_author=""
+-    local tag_email=""
+-    local tag_date=""
+-
+-    if [[ "$unreleased" = true ]]; then
+-        tag_author=$(git config user.name)
+-        tag_email=$(git config user.email)
+-        tag_date=$(date --rfc-2822)
+-    else
+-        tag_author=$(git -C sysbox log -1 --format=%aN v$1)
+-        tag_email=$(git -C sysbox log -1 --format=%ae v$1)
+-        tag_date=$(git -C sysbox log -1 --format=%aD v$tag)
+-    fi
++    local tag_author="author"
++    local tag_email="author@localhost"
++    local tag_date=$(date --rfc-2822)
+ 
+     echo -e "\n -- ${tag_author} <${tag_email}>  ${tag_date}\n"
+ }
diff --git a/pkgr-apply-custom-changes.patch b/pkgr-apply-custom-changes.patch
new file mode 100644
index 000000000..96d0d04a8
--- /dev/null
+++ b/pkgr-apply-custom-changes.patch
@@ -0,0 +1,14 @@
+diff --git a/Makefile b/Makefile
+index 2df228f..583dea1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -80,6 +80,9 @@ sysbox-ce-repo:
+ sources/sysbox:
+ 	@printf "\n*** Cloning sysbox-ce superproject repository to $(CE_SOURCES) ***\n\n"
+ 	@git clone --recursive https://github.com/nestybox/sysbox.git sources/sysbox
++	(cd sources/sysbox/sysbox-mgr && git apply ../../../../sysbox-mgr-dont-call-errorf.patch)
++	cp ../VERSION_OVERRIDE sources/sysbox/VERSION
++
+ 
+ ##@ Testing targets
+ 
diff --git a/pkgr-copyright-and-license.patch b/pkgr-copyright-and-license.patch
new file mode 100644
index 000000000..0cad3f282
--- /dev/null
+++ b/pkgr-copyright-and-license.patch
@@ -0,0 +1,42 @@
+diff --git a/deb/sysbox-ce/control b/deb/sysbox-ce/control
+index 8cc5766..3088556 100644
+--- a/deb/sysbox-ce/control
++++ b/deb/sysbox-ce/control
+@@ -1,12 +1,11 @@
+ Source: sysbox-ce
+ Section: admin
+ Priority: optional
+-Maintainer: Nestybox <contact@nestybox.com>
++Maintainer: unset <unset@localhost>
+ Build-Depends: debhelper (>= 10~),
+                bash,
+ Standards-Version: 4.1.4
+-Homepage: nestybox.com
+-Vcs-Git: git://github.com/nestybox/sysbox.git
++Homepage: unset
+ 
+ Package: sysbox-ce
+ Architecture: linux-any
+@@ -19,7 +18,4 @@ Depends: ${shlibs:Depends},
+          lsb-release,
+          rsync,
+          iptables
+-Description: Sysbox Community Edition (CE) is a next-generation container runtime,
+- developed by Nestybox, that enables deployment of containers that are capable of
+- running not just micro-services, but also system software such as Docker, Kubernetes,
+- Systemd, etc., inside the container, easily and securely.
+\ No newline at end of file
++Description: 
+\ No newline at end of file
+diff --git a/deb/sysbox-ce/copyright b/deb/sysbox-ce/copyright
+index b4d8d5d..f5696ed 100644
+--- a/deb/sysbox-ce/copyright
++++ b/deb/sysbox-ce/copyright
+@@ -10,3 +10,7 @@ Disclaimer:
+ Files: *
+ Copyright: 2019-2022 Nestybox Inc.  All rights reserved.
+ License: Apache License, Version 2.0.
++
++Files: 
++Copyright: 2026 <unset-yet>.  All rights reserved.
++License: Apache License, Version 2.0.
diff --git a/sysbox-fs b/sysbox-fs
index b3179b68d..4096e51ba 160000
--- a/sysbox-fs
+++ b/sysbox-fs
@@ -1 +1 @@
-Subproject commit b3179b68daf7688847c290fba22d39320ca7bcba
+Subproject commit 4096e51ba130cbe19fec50ed097bf9baad0ec93d
diff --git a/sysbox-fs.patch b/sysbox-fs.patch
new file mode 100644
index 000000000..e76f5633d
--- /dev/null
+++ b/sysbox-fs.patch
@@ -0,0 +1,13 @@
+diff --git a/Makefile b/Makefile
+index b2c2de8..32f8f40 100644
+--- a/Makefile
++++ b/Makefile
+@@ -30,7 +30,7 @@ LIBSPIDMON_SRC := $(shell find $(LIBPIDMON_DIR) 2>&1 | grep -E '.*\.(go)')
+ NSENTER_DIR := ../sysbox-runc/libcontainer/nsenter
+ NSENTER_SRC := $(shell find $(NSENTER_DIR) 2>&1 | grep -E '.*\.(c|h|go)')
+ 
+-COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
++COMMIT_NO := $(shell git rev-parse HEAD)
+ COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
+ BUILT_AT := $(shell date)
+ BUILT_BY := $(shell git config user.name)
diff --git a/sysbox-mgr-dont-call-errorf.patch b/sysbox-mgr-dont-call-errorf.patch
new file mode 100644
index 000000000..a9fb81e8d
--- /dev/null
+++ b/sysbox-mgr-dont-call-errorf.patch
@@ -0,0 +1,87 @@
+diff --git a/utils_test.go b/utils_test.go
+index 5776272..05b3bb7 100644
+--- a/utils_test.go
++++ b/utils_test.go
+@@ -232,7 +232,7 @@ user2:165536:65536
+ sysbox:231072:268435456
+ `
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 268435456, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// at beginning of range
+@@ -241,7 +241,7 @@ sysbox:231072:268435456
+ user2:165536:65536`
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// in the middle of range
+@@ -252,13 +252,13 @@ sysbox:165536:65536
+ user2:231072:65536`
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// not enought ids
+ 	subidFilePre = `user1:100000:65536`
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 600034465, 100000, 600100000); err == nil {
+-		t.Errorf("configSubidRange(): expected alloc error, got no error")
++		t.Error("configSubidRange(): expected alloc error, got no error")
+ 	}
+ 
+ 	// do not disturb existing sysbox entry
+@@ -269,7 +269,7 @@ user3:296608:65536`
+ 	subidFilePost = subidFilePre
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// replace redundant sysbox entries with one entry
+@@ -283,7 +283,7 @@ user3:165536:65536
+ sysbox:231072,65536`
+ 
+ 	if err := testConfigSubidRangeHelper(subidFilePre, subidFilePost, 65536, 100000, 600100000); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ }
+ 
+@@ -338,7 +338,7 @@ some data
+ 
+ 	want := []uint64{100000, 600100000, 100000, 2147483648}
+ 	if err := testGetSubidLimitsHelper(fileData, want); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ 
+ 	// login.defs file without uid(gid) limits
+@@ -348,7 +348,7 @@ some data
+ 
+ 	want = []uint64{100000, 4294967295, 100000, 4294967295}
+ 	if err := testGetSubidLimitsHelper(fileData, want); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ }
+ 
+diff --git a/volMgr/volMgr_test.go b/volMgr/volMgr_test.go
+index dad573e..6bbb182 100644
+--- a/volMgr/volMgr_test.go
++++ b/volMgr/volMgr_test.go
+@@ -191,7 +191,7 @@ func TestCreateVol(t *testing.T) {
+ 
+ 	// create the volume and verify all is good
+ 	if _, err := testCreateVolWork(id, hostDir, rootfs, mountpoint, uid, gid, false); err != nil {
+-		t.Errorf(err.Error())
++		t.Error(err.Error())
+ 	}
+ }
+ 
diff --git a/sysbox-mgr.patch b/sysbox-mgr.patch
new file mode 100644
index 000000000..2a780332d
--- /dev/null
+++ b/sysbox-mgr.patch
@@ -0,0 +1,19 @@
+diff --git a/Makefile b/Makefile
+index 8de0a67..80e1999 100644
+--- a/Makefile
++++ b/Makefile
+@@ -21,10 +21,10 @@ SYSMGR_GRPC_SRC := $(shell find $(SYSMGR_GRPC_DIR) 2>&1 | grep -E '.*\.(c|h|go|p
+ SYSLIB_DIR := ../sysbox-libs
+ SYSLIB_SRC := $(shell find $(SYSLIB_DIR) 2>&1 | grep -E '.*\.(c|h|go|proto)$$')
+ 
+-COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
+-COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
+-BUILT_AT := $(shell date)
+-BUILT_BY := $(shell git config user.name)
++COMMIT_NO := "unset"
++COMMIT ?= "unset"
++BUILT_AT := "unset"
++BUILT_BY := "unset"
+ 
+ LDFLAGS := -X 'main.edition=${EDITION}' -X main.version=${VERSION} \
+ 		-X main.commitId=$(COMMIT) -X 'main.builtAt=$(BUILT_AT)' \
diff --git a/sysbox-pkgr.patch b/sysbox-pkgr.patch
new file mode 100644
index 000000000..21927c11a
--- /dev/null
+++ b/sysbox-pkgr.patch
@@ -0,0 +1,140 @@
+diff --git a/deb/Makefile b/deb/Makefile
+index 6875870..dbfd1f3 100644
+--- a/deb/Makefile
++++ b/deb/Makefile
+@@ -11,6 +11,7 @@
+ 	ubuntu-bionic      \
+ 	ubuntu-focal       \
+ 	ubuntu-jammy       \
++	ubuntu-resolute    \
+ 	clean
+ 
+ SHELL:=/bin/bash
+@@ -31,11 +32,11 @@ endif
+ # that this is currently a requirement to build official Sysbox
+ # packages as only Impish (or later) carries ID-mapped mount support
+ # in the kernel and associated clibs.
+-RELEASE_BASELINE_IMAGE=ubuntu-jammy
++RELEASE_BASELINE_IMAGE=ubuntu-resolute
+ 
+ # Go version to utilize in building process.
+ GO_BASE_IMAGE=golang
+-GO_VERSION:=1.22
++GO_VERSION:=1.26
+ GO_IMAGE=$(GO_BASE_IMAGE):$(GO_VERSION)
+ 
+ # Sysbox source-code locations.
+@@ -150,6 +151,13 @@ ubuntu-jammy: $(SOURCES)
+ 	$(DOCKER_RUN)
+ 	$(CHOWN) -R $(shell id -u):$(shell id -g) build/$(ARCH)/$@
+ 
++ubuntu-resolute: ## Build Ubuntu Resolute package
++ubuntu-resolute: $(SOURCES)
++	@echo "== Building packages for $@ =="
++	$(DOCKER_BUILD)
++	$(DOCKER_RUN)
++	$(CHOWN) -R $(shell id -u):$(shell id -g) build/$(ARCH)/$@
++
+ generic: ## Build generic deb package (release purposes)
+ generic: $(SOURCES)
+ 	@echo "== Building generic release package"
+diff --git a/deb/ubuntu-resolute/Dockerfile b/deb/ubuntu-resolute/Dockerfile
+new file mode 100644
+index 0000000..4059c61
+--- /dev/null
++++ b/deb/ubuntu-resolute/Dockerfile
+@@ -0,0 +1,94 @@
++ARG GO_IMAGE
++ARG BASE_IMAGE=ubuntu:resolute
++ARG DEBIAN_FRONTEND=noninteractive
++
++FROM ${GO_IMAGE} as golang
++
++FROM ${BASE_IMAGE}
++
++RUN echo 'debconf debconf/frontend select Noninteractive' | debconf-set-selections && \
++    apt-get update &&                            \
++    apt-get install -y --no-install-recommends   \
++    build-essential                              \
++    ca-certificates                              \
++    devscripts                                   \
++    equivs                                       \
++    git                                          \
++    wget                                         \
++    pkg-config                                   \
++    libnet-dev                                   \
++    libseccomp2                                  \
++    libseccomp-dev                               \
++    iproute2                                     \
++    kmod                                         \
++    curl                                         \
++    unzip &&                                     \
++    \
++    # Housekeeping
++    apt-get clean -y &&                          \
++    rm -rf                                       \
++    /var/cache/debconf/*                         \
++    /var/lib/apt/lists/*                         \
++    /var/log/*                                   \
++    /tmp/*                                       \
++    /var/tmp/*                                   \
++    /usr/share/doc/*                             \
++    /usr/share/man/*                             \
++    /usr/share/local/*
++
++ARG arch
++ENV ARCH=${arch}
++ENV GOPATH /go
++ENV PATH $PATH:/usr/local/go/bin:$GOPATH/bin:/root/.local/bin
++
++ARG DEB_FILES
++COPY ${DEB_FILES} /root/build-deb/debian
++RUN mk-build-deps -t "apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y" -i /root/build-deb/debian/control
++
++ENV BASE_IMAGE=${BASE_IMAGE}
++ENV SYSBOX_RELEASE true
++
++COPY --from=golang /usr/local/go /usr/local/go
++
++# Let's explicitly set go-module feature to 'auto' mode (default as per Go 1.13) to avoid
++# potential changes to this feature's default mode in the future. Even though we are
++# relying on modules for the package's building process, we are enabling 'auto' mode to
++# allow 'go get' traditional behavior (fetch entire git repo). Notice that we need git's
++# metadata to allow a git-checkout operation further below.
++ENV GO111MODULE=auto
++RUN go env -w GONOSUMDB=github.com/nestybox
++
++# Install protoc compiler for gRPC.
++RUN if [ "${arch}" = "amd64" ]; then arch_str="x86_64"; \
++    elif [ "${arch}" = "arm64" ]; then arch_str="aarch_64"; \
++    else echo "Unsupported platform: ${arch}"; exit; fi \
++    && curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v3.15.8/protoc-3.15.8-linux-${arch_str}.zip \
++    && unzip protoc-3.15.8-linux-${arch_str}.zip -d $HOME/.local \
++    && export PATH="$PATH:$HOME/.local/bin" \
++    && go install github.com/golang/protobuf/protoc-gen-go@latest \
++    && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
++    && export PATH="$PATH:$(go env GOPATH)/bin"
++
++# Install Docker
++RUN curl -fsSL https://get.docker.com -o get-docker.sh \
++    && sh get-docker.sh
++ADD https://raw.githubusercontent.com/docker/docker-ce/master/components/cli/contrib/completion/bash/docker /etc/bash_completion.d/docker.sh
++
++# Use the old definition for SECCOMP_NOTIF_ID_VALID in /usr/include/linux/seccomp.h
++#
++# This is needed because the definition changed in the mainline kernel
++# on 06/2020 (from SECCOMP_IOR -> SECCOMP_IOW), and some distros we
++# support have picked it up in their latest releases / kernels
++# updates. The kernel change was backward compatible, so by using the
++# old definition, we are guaranteed it will work on kernels before and
++# after the change. On the other hand, if we were to use the new
++# definition, seccomp notify would fail when sysbox runs in old
++# kernels.
++RUN sed -i 's/^#define SECCOMP_IOCTL_NOTIF_ID_VALID[ \t]*SECCOMP_IOW(2, __u64)/#define SECCOMP_IOCTL_NOTIF_ID_VALID   SECCOMP_IOR(2, __u64)/g' /usr/include/linux/seccomp.h
++
++WORKDIR /root/build-deb
++COPY sources/ /sources
++COPY build-deb /root/build-deb/build-deb
++COPY changelog_convert.sh /root/build-deb/changelog_convert.sh
++
++ENTRYPOINT ["/root/build-deb/build-deb"]
diff --git a/sysbox-runc.patch b/sysbox-runc.patch
new file mode 100644
index 000000000..9306a5181
--- /dev/null
+++ b/sysbox-runc.patch
@@ -0,0 +1,19 @@
+diff --git a/Makefile b/Makefile
+index 1cb90bb9..647490d5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -38,10 +38,10 @@ RUNC_IMAGE := runc_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN))
+ NBOX := /root/nestybox
+ RUNC := $(NBOX)/sysbox-runc
+ 
+-COMMIT_NO := $(shell git rev-parse HEAD 2> /dev/null || true)
+-COMMIT ?= $(if $(shell git status --porcelain --untracked-files=no),$(COMMIT_NO)-dirty,$(COMMIT_NO))
+-BUILT_AT := $(shell date)
+-BUILT_BY := $(shell git config user.name)
++COMMIT_NO := "unset"
++COMMIT ?= "unset"
++BUILT_AT := "unset"
++BUILT_BY := "unset"
+ 
+ SYSIPC_DIR := ../sysbox-ipc
+ SYSIPC_SRC := $(shell find $(SYSIPC_DIR) 2>&1 | grep -E '.*\.(c|h|go|proto)$$')
diff --git a/tests/Dockerfile.ubuntu-resolute b/tests/Dockerfile.ubuntu-resolute
new file mode 100644
index 000000000..6bd914f10
--- /dev/null
+++ b/tests/Dockerfile.ubuntu-resolute
@@ -0,0 +1,227 @@
+#
+# Sysbox Test Container Dockerfile (Ubuntu-Noble image)
+#
+# This Dockerfile creates the sysbox test container image. The image
+# contains all dependencies needed to build, run, and test sysbox.
+#
+# The image does not contain sysbox itself; the sysbox repo
+# must be bind mounted into the image. It can then be built,
+# installed, and executed within the container.
+#
+# The image must be run as a privileged container (i.e., docker run --privileged ...)
+# Refer to the sysbox Makefile test targets.
+#
+# This Dockerfile is based on a similar Dockerfile in the OCI runc
+# github repo, but adapted to sysbox testing.
+#
+# Instructions:
+#
+# docker build -t sysbox-test .
+#
+
+FROM ubuntu:noble
+
+# K8s version for k8s-in-docker (i.e., this should be equal or greater than the
+# version of K8s running inside the k8s-in-docker container).
+ARG k8s_version=v1.28
+ARG k8s_version_full=v1.28.2
+
+# CRI-O & crictl version for testing sysbox pods; should match K8s version.
+ARG crio_version=v1.28
+ARG crictl_version=v1.28.0
+
+# Desired platform architecture to build upon.
+ARG sys_arch
+ENV SYS_ARCH=${sys_arch}
+ARG target_arch
+ENV TARGET_ARCH=${target_arch}
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+    acl \
+    build-essential \
+    gcc-x86-64-linux-gnu \
+    libc6-dev-amd64-cross \
+    linux-libc-dev-amd64-cross \
+    gcc-aarch64-linux-gnu \
+    libc6-dev-arm64-cross \
+    linux-libc-dev-arm64-cross \
+    gcc-arm-linux-gnueabi \
+    libc6-dev-armel-cross \
+    linux-libc-dev-armel-cross \
+    gcc-arm-linux-gnueabihf \
+    libc6-dev-armhf-cross \
+    linux-libc-dev-armhf-cross \
+    automake \
+    autoconf \
+    libtool \
+    procps \
+    psmisc \
+    nano \
+    less \
+    curl \
+    sudo \
+    gawk \
+    git \
+    iptables \
+    jq \
+    pkg-config \
+    libaio-dev \
+    libcap-dev \
+    libprotobuf-dev \
+    libnl-3-dev \
+    libnet-dev \
+    libseccomp2 \
+    libseccomp-dev \
+    protobuf-c-compiler \
+    protobuf-compiler \
+    python3 \
+    uidmap \
+    kmod \
+    unzip \
+    time \
+    net-tools \
+    lsb-release \
+    wget \
+    lsof \
+    iproute2 \
+    iputils-ping \
+    ca-certificates \
+    bc \
+    ssh-client \
+    shellcheck \
+    gperf \
+    # sysbox deps
+    fuse3 \
+    rsync \
+    bash-completion \
+    attr \
+    tree \
+    strace \
+    --no-install-recommends \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* \
+    && echo ". /etc/bash_completion" >> /etc/bash.bashrc \
+    && ssh-keygen -t rsa -N "" -f ~/.ssh/id_rsa \
+    && echo "    StrictHostKeyChecking accept-new" >> /etc/ssh/ssh_config
+
+# Install Golang
+RUN wget https://go.dev/dl/go1.24.9.linux-${sys_arch}.tar.gz && \
+    tar -C /usr/local -xzf go1.24.9.linux-${sys_arch}.tar.gz && \
+    /usr/local/go/bin/go env -w GONOSUMDB=/root/nestybox
+
+ENV GOPATH=/go
+ENV PATH=$GOPATH/bin:/usr/local/go/bin:$PATH
+RUN go env -w GONOSUMDB=/root/nestybox && \
+    mkdir -p "$GOPATH/src" "$GOPATH/bin" && \
+    chmod -R 777 "$GOPATH"
+
+# Add a dummy user for the rootless integration tests; needed by the
+# `git clone` operations below.
+RUN useradd -u2000 -m -d/home/rootless -s/bin/bash rootless
+
+# install bats
+RUN cd /tmp \
+    && git clone https://github.com/sstephenson/bats.git \
+    && cd bats \
+    && git reset --hard 03608115df2071fff4eaaff1605768c275e5f81f \
+    && ./install.sh /usr/local \
+    && rm -rf /tmp/bats
+
+# install protoc compiler for gRPC
+RUN if [ "$sys_arch" = "amd64" ] ; then arch_str="x86_64"; \
+    elif [ "$sys_arch" = "arm64" ]; then arch_str="aarch_64"; \
+    else echo "Unsupported platform: ${sys_arch}"; exit; fi \
+    && curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v3.15.8/protoc-3.15.8-linux-${arch_str}.zip \
+    && unzip protoc-3.15.8-linux-${arch_str}.zip -d $HOME/.local \
+    && export PATH="$PATH:$HOME/.local/bin" \
+    && go install github.com/golang/protobuf/protoc-gen-go@latest \
+    && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
+    && export PATH="$PATH:$(go env GOPATH)/bin"
+
+# Install Docker
+RUN curl -fsSL https://get.docker.com -o get-docker.sh \
+    && sh get-docker.sh
+ADD https://raw.githubusercontent.com/docker/docker-ce/master/components/cli/contrib/completion/bash/docker /etc/bash_completion.d/docker.sh
+
+# Go Dlv for debugging
+RUN go install github.com/go-delve/delve/cmd/dlv@latest
+
+# Install Kubectl for k8s-in-docker integration-testing. Notice that we are explicitly
+# stating the kubectl version to download, which should match the K8s release
+# deployed in the K8s-in-docker nodes (L2).
+RUN cd /tmp && curl -LO "https://dl.k8s.io/release/${k8s_version_full}/bin/linux/amd64/kubectl" \
+    && install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl \
+    && rm /tmp/kubectl
+
+# Install the upstream CRI-O so we get the cri-o binary plus all config files,
+# etc. Later we will replace the binary with our forked Nestybox CRI-O that
+# works with Sysbox.
+#
+# Instructions: https://cri-o.io/
+RUN apt-get update && apt-get install -y gpg software-properties-common
+RUN curl -fsSL https://download.opensuse.org/repositories/isv:/cri-o:/stable:/${crio_version}/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/cri-o-apt-keyring.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/cri-o-apt-keyring.gpg] https://download.opensuse.org/repositories/isv:/cri-o:/stable:/${crio_version}/deb/ /" | tee /etc/apt/sources.list.d/cri-o.list \
+    && apt-get update \
+    && apt-get install -y cri-o
+
+# Build and install the Nestybox CRI-O (for testing deployment of pods with sysbox (aka "sysbox pods"))
+# NOTE: unlike prior Ubuntu distros, requires explicit CGO_LDFLAGS for lgpgme, lpgpg-error, and lassuan when building CRI-O.
+RUN apt-get update && apt-get install -y --no-install-recommends libgpgme-dev libgpg-error-dev libassuan-dev \
+    && mkdir -p /tmp/crio-build \
+    && git clone https://github.com/nestybox/cri-o.git /tmp/crio-build/cri-o \
+    && git -C /tmp/crio-build/cri-o checkout -b ${crio_version}-sysbox origin/${crio_version}-sysbox \
+    && export CGO_LDFLAGS="-lgpgme -lgpg-error -lassuan" && cd /tmp/crio-build/cri-o && make binaries \
+    && mv /usr/bin/crio /usr/bin/crio.orig \
+    && cp /tmp/crio-build/cri-o/bin/crio-static /usr/bin/crio \
+    && rm -rf /tmp/crio-build
+
+RUN wget https://github.com/kubernetes-sigs/cri-tools/releases/download/${crictl_version}/crictl-${crictl_version}-linux-${sys_arch}.tar.gz \
+    && sudo tar zxvf crictl-${crictl_version}-linux-${sys_arch}.tar.gz -C /usr/local/bin \
+    && rm -f crictl-${crictl_version}-linux-${sys_arch}.tar.gz
+
+# Container CNIs (needed by CRI-O)
+RUN curl -fsSL https://pkgs.k8s.io/core:/stable:/${k8s_version}/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/${k8s_version}/deb/ /" | tee /etc/apt/sources.list.d/kubernetes.list \
+    && apt-get update \
+    && apt-get install kubernetes-cni
+
+# Dasel (for yaml, toml, json parsing) (https://github.com/TomWright/dasel)
+# Note: manually download Dasel v1 as our testContainerInit script does not yet support Dasel v2.
+RUN wget https://github.com/TomWright/dasel/releases/download/v1.27.2/dasel_linux_${sys_arch} &&  mv dasel_linux_${sys_arch} dasel && chmod +x dasel \
+    && mv ./dasel /usr/local/bin/dasel
+
+# K8s.io KinD
+RUN go install sigs.k8s.io/kind@v0.24.0
+
+# Use the old definition for SECCOMP_NOTIF_ID_VALID in /usr/include/linux/seccomp.h
+#
+# This is needed because the definition changed in the mainline kernel
+# on 06/2020 (from SECCOMP_IOR -> SECCOMP_IOW), and some distros we
+# support have picked it up in their latest releases / kernels
+# updates. The kernel change was backward compatible, so by using the
+# old definition, we are guaranteed it will work on kernels before and
+# after the change. On the other hand, if we were to use the new
+# definition, seccomp notify would fail when sysbox runs in old
+# kernels.
+RUN sed -i 's/^#define SECCOMP_IOCTL_NOTIF_ID_VALID[ \t]*SECCOMP_IOW(2, __u64)/#define SECCOMP_IOCTL_NOTIF_ID_VALID   SECCOMP_IOR(2, __u64)/g' /usr/include/linux/seccomp.h
+
+# Paketo buildpacks
+RUN add-apt-repository ppa:cncf-buildpacks/pack-cli \
+    && apt-get update \
+    && apt-get install -y pack-cli
+
+# sysbox env
+RUN useradd sysbox \
+    && mkdir -p /var/lib/sysboxfs
+
+# test scripts
+COPY scr/testContainerInit /usr/bin
+COPY scr/testContainerCleanup /usr/bin
+COPY scr/buildContainerInit /usr/bin
+COPY bin/userns_child_exec_${sys_arch} /usr/bin
+
+RUN mkdir -p /root/nestybox
+WORKDIR /root/nestybox/sysbox
+CMD ["/bin/bash"]
diff --git a/trick-to-workarount-always-fail-setup.patch b/trick-to-workarount-always-fail-setup.patch
new file mode 100644
index 000000000..c166816b9
--- /dev/null
+++ b/trick-to-workarount-always-fail-setup.patch
@@ -0,0 +1,14 @@
+diff --git a/Makefile b/Makefile
+index 2df228f..9b3e2aa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -127,3 +127,9 @@ clean-ce-deb: ## Remove sysbox-ce DEB package
+ clean-ce-rpm: ## Remove sysbox-ce RPM package
+ 	$(eval export EDITION=ce)
+ 	$(MAKE) -C rpm --no-print-directory clean
++
++generic:
++	echo "Maybe built"
++
++.PHONY: generic 
++