diff --git a/Dockerfile_tuxrun b/Dockerfile_tuxrun
index bac59e2..f57031b 100644
--- a/Dockerfile_tuxrun
+++ b/Dockerfile_tuxrun
@@ -103,6 +103,7 @@ RUN apt-get update && apt-get install --yes --no-install-recommends \
     texinfo \
     time \
     traceroute \
+    ubuntu-keyring \
     unzip \
     uuid-dev \
     vim \
@@ -118,9 +119,17 @@ RUN . /build/.env/bin/activate && pip install -U tuxrun
 COPY mkqemu.sh /usr/local/bin/mkqemu.sh
 RUN cd /tmp && /usr/local/bin/mkqemu.sh
 
+RUN mkdir -p /rootfs
+COPY systemd-debian-autologin.sh /usr/local/bin/systemd-debian-autologin.sh
+COPY mkext4_rv64_ubuntu.sh /usr/local/bin/mkext4_rv64_ubuntu.sh
+RUN cd /rootfs && /usr/local/bin/mkext4_rv64_ubuntu.sh
+
 RUN mkdir -p /build
 WORKDIR /build
 
+RUN git clone https://github.com/riscv-software-src/opensbi -b v1.6
+RUN cd opensbi && make ARCH=riscv CROSS_COMPILE=riscv64-linux-gnu- PLATFORM=generic
+
 RUN git clone https://github.com/linux-riscv/tuxrun -b dev/alex/riscv64
 
 RUN git clone https://github.com/linux-riscv/test-definitions -b dev/alex/riscv64
@@ -138,4 +147,46 @@ RUN mkdir -p /build/libhugetlbfs
 RUN make ARCH=riscv64 PREFIX=/build/ install
 RUN cd /build && tar --transform "s/build/\/opt/" -cJvf libhugetlbfs.tar.xz /build/libhugetlbfs
 
+# xfs
+WORKDIR /build
+RUN git clone git://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git
+RUN dpkg --add-architecture riscv64
+RUN apt-get update && apt-get install --yes --no-install-recommends 			\
+	acl:riscv64 attr:riscv64 libacl1-dev:riscv64 libaio-dev:riscv64 		\
+	libcap-dev:riscv64 libgdbm-dev:riscv64 libtool:riscv64 xfslibs-dev:riscv64	\
+	libtool-bin:riscv64 liburing-dev:riscv64 libuuid1:riscv64 quota:riscv64 	\
+	uuid-dev:riscv64 uuid-runtime:riscv64 libgdbm-compat-dev:riscv64
+# FIXME have to install twice because the first one fails...
+RUN cd xfstests-dev && make CC=riscv64-linux-gnu-gcc LD=riscv64-linux-gnu-ld PKG_LIB_DIR=/build/xfstests install
+RUN cd xfstests-dev && make CC=riscv64-linux-gnu-gcc LD=riscv64-linux-gnu-ld PKG_LIB_DIR=/build/xfstests install
+RUN cd /build && tar --transform "s/build/\/opt/" -cJvf xfstests.tar.xz /build/xfstests
+# FIXME python3:riscv64 overwrites host python3...
+RUN apt remove --yes python3.13-minimal:riscv64
+RUN apt-get install --yes --no-install-recommends \
+	python3-setproctitle python3-yaml python3-guestfs python3-netifaces python3-requests python3-pexpect
+
+# cfi
+# We need a cfi enabled toolchain, so let's build it
+# Build fails for now, so instead use an already built toolchain un /build
+# from here https://gitlab.ba.rivosinc.com/api/v4/projects/704/packages/generic/cfi_toolchain/sept2024/cfi_sept2024.tar.gz
+# It must be downloaded beforehand.
+#WORKDIR /build
+#RUN git clone https://github.com/sifive/riscv-gnu-toolchain -b cfi-dev
+#WORKDIR /build/riscv-gnu-toolchain
+#RUN git config --global url."https://github.com/".insteadOf "git@github.com:"
+#RUN mkdir build
+#RUN ./configure --prefix=/build/riscv-gnu-toolchain/build --with-arch=rv64gc --enable-linux --disable-gdb
+#RUN make
+#RUN make build-qemu
+WORKDIR /build
+COPY cfi_sept2024.tar.gz /build
+RUN tar xvf cfi_sept2024.tar.gz
+RUN mkdir -p /build/cfi
+COPY tests/cfi/main.c /build/cfi
+WORKDIR /build/cfi
+RUN riscv64-linux-gnu-gcc main.c -o not_cfi_compiled_should_fail -static
+RUN PATH=/build/INSTALL_Sept24/bin:$PATH riscv64-unknown-linux-gnu-gcc main.c -o cfi_compiled_should_succeed -static
+RUN cd /build && tar --transform "s/build/\/opt/" -cJvf isolated-cfi.tar.xz /build/cfi
+
+WORKDIR /build
 RUN mkdir -p /build/squad_json
diff --git a/mkext4_rv64_ubuntu.sh b/mkext4_rv64_ubuntu.sh
new file mode 100755
index 0000000..ff987fd
--- /dev/null
+++ b/mkext4_rv64_ubuntu.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+# SPDX-FileCopyrightText: 2025 Rivos Inc.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Builds an RV64 Ubuntu rootfs.
+
+set -euo pipefail
+set -x
+
+d=$(dirname "${BASH_SOURCE[0]}")
+distro=noble
+
+packages=(
+        arping
+        bc
+        binutils
+        btrfs-progs
+        dosfstools
+        elfutils
+        ethtool
+        exfatprogs
+        f2fs-tools
+        fsverity
+        iproute2
+        iptables
+        jq
+        keyutils
+        libasound2t64
+        libcap2
+        libelf1
+        libnuma1
+        net-tools
+        netsniff-ng
+        openssl
+        psmisc
+        smcroute
+        socat
+        strace
+        systemd-sysv
+        tcpdump
+        udev
+        uuid-runtime
+        xfsprogs
+        zlib1g
+)
+packages=$(IFS=, && echo "${packages[*]}")
+
+name="rootfs_rv64_ubuntu_$(date +%Y.%m.%d).ext4"
+
+mmdebstrap --include="$packages" \
+           --architecture=riscv64 \
+           --format=ext4 \
+           --components="main restricted multiverse universe" \
+           --customize-hook=$d/systemd-debian-autologin.sh \
+           --skip=cleanup/reproducible \
+           "${distro}" \
+           "${name}"