diff --git a/tools/mkimage-iso/Dockerfile b/tools/mkimage-iso/Dockerfile
new file mode 100644
index 000000000..7241b487e
--- /dev/null
+++ b/tools/mkimage-iso/Dockerfile
@@ -0,0 +1,15 @@
+FROM linuxkit/alpine:daed76b8f1d28cdeeee215a95b9671c682a405dc AS mirror
+RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
+RUN apk add --no-cache --initdb -p /out \
+    alpine-baselayout \
+    busybox \
+    cdrkit \
+    libarchive-tools \
+    && true
+RUN mv /out/etc/apk/repositories.upstream /out/etc/apk/repositories
+
+FROM scratch
+WORKDIR /
+COPY --from=mirror /out/ /
+COPY . .
+ENTRYPOINT [ "/make-iso" ]
diff --git a/tools/mkimage-iso/build.yml b/tools/mkimage-iso/build.yml
new file mode 100644
index 000000000..0c51e1a94
--- /dev/null
+++ b/tools/mkimage-iso/build.yml
@@ -0,0 +1,3 @@
+image: mkimage-iso
+arches:
+  - amd64
diff --git a/tools/mkimage-iso/make-iso b/tools/mkimage-iso/make-iso
new file mode 100755
index 000000000..875a557d5
--- /dev/null
+++ b/tools/mkimage-iso/make-iso
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+set -e
+
+mkdir -p /tmp/iso
+cd /tmp/iso
+
+# input is a tarball of filesystem on stdin
+# output is an iso on stdout
+
+# extract. BSD tar auto recognises compression, unlike GNU tar
+# only if stdin is a tty, if so need files volume mounted...
+[ -t 0 ] || bsdtar xzf -
+
+genisoimage -o ../linuxkit.iso -l -J -R \
+		-joliet-long -input-charset utf8 \
+                -V LinuxKit .
+cat ../linuxkit.iso