dotnet · richlander · Apr 30, 2026 · Jun 11, 2026 · Jun 11, 2026 · Jun 11, 2026
@@ -0,0 +1,57 @@
+ARG ANDROID_SDK_ROOT=/usr/local/android-sdk
+ARG ANDROID_NDK_VERSION=27.2.12479018
+ARG ANDROID_NDK_ROOT=$ANDROID_SDK_ROOT/ndk/$ANDROID_NDK_VERSION
+FROM mcr.microsoft.com/openjdk/jdk:17-mariner AS android-sdk-download
+ARG ANDROID_SDK_ROOT
+ARG ANDROID_NDK_VERSION
+ARG ANDROID_NDK_ROOT
+
+# Dependencies for Android SDK install
+RUN tdnf update -y \
+    && tdnf install -y \
+        # Android dependencies
+        wget \
+        zip \
+        unzip
+
+# Grab the necessary Android SDK packages / tools
+RUN wget https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
+    && echo "2d2d50857e4eb553af5a6dc3ad507a17adf43d115264b1afc116f95c92e5e258 commandlinetools-linux-11076708_latest.zip" | sha256sum -c \
+    && mkdir -p /usr/local/cmdline-tools \
+    && unzip commandlinetools-linux-11076708_latest.zip -d /usr/local/cmdline-tools \
+    && rm -f commandlinetools-linux-11076708_latest.zip \
+    && yes | /usr/local/cmdline-tools/cmdline-tools/bin/sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --licenses
+
+RUN yes | /usr/local/cmdline-tools/cmdline-tools/bin/sdkmanager --licenses
+RUN /usr/local/cmdline-tools/cmdline-tools/bin/sdkmanager --sdk_root="${ANDROID_SDK_ROOT}" --install "build-tools;33.0.0" "platforms;android-33" "ndk;${ANDROID_NDK_VERSION}"
+
+# Remove all components of NDK that are flagged by security scanners
+RUN rm -r ${ANDROID_NDK_ROOT}/toolchains/llvm/prebuilt/linux-x86_64/python3/lib/python3.11/site-packages/
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-llvm-amd64
+
+# Install Microsoft OpenJDK from the Microsoft OpenJDK 17 Mariner image.
+ENV LANG=en_US.UTF-8
+ENV JAVA_HOME=/usr/lib/jvm/msopenjdk-17
+ENV PATH=$JAVA_HOME/bin:$PATH
+COPY --from=mcr.microsoft.com/openjdk/jdk:17-mariner $JAVA_HOME $JAVA_HOME
+ARG ANDROID_SDK_ROOT
+ARG ANDROID_NDK_VERSION
+ARG ANDROID_NDK_ROOT
+
+
+# Dependencies for Android build
+RUN dnf update -y \
+    && dnf install -y \
+        # Common dependencies
+        binutils \
+        # Android dependencies
+        zip \
+        unzip \
+        # linux-bionic build dependencies
+        openssl-devel
+
+ENV ANDROID_SDK_ROOT=${ANDROID_SDK_ROOT}
+ENV ANDROID_NDK_ROOT=${ANDROID_NDK_ROOT}
+
+COPY --from=android-sdk-download $ANDROID_SDK_ROOT $ANDROID_SDK_ROOT
@@ -0,0 +1,6 @@
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-android-amd64
+
+RUN dnf update -y \
+    && dnf install -y \
+        moby-engine \
+        docker-cli
@@ -0,0 +1,33 @@
+FROM mcr.microsoft.com/dotnet/sdk:10.0-azurelinux3.0 AS powershell
+ENV POWERSHELL_VERSION=7.6.1
+RUN dotnet tool install --tool-path /powershell --version ${POWERSHELL_VERSION} PowerShell
+
+FROM mcr.microsoft.com/dotnet/runtime:10.0-azurelinux3.0 AS runtime
+
+FROM mcr.microsoft.com/azurelinux-beta/base/core:4.0
+
+# Install .NET runtime dependencies (inlined from runtime-deps) and build tools
+RUN dnf update -y && \
+    dnf install -y \
+        gawk \
+        azure-cli \
+        ca-certificates \
+        # added to ensure latest patches over the base image
+        curl \
+        git \
+        icu \
+        nodejs24 \
+        nodejs24-npm \
+        # provides 'useradd', required by Azure DevOps
+        shadow-utils \
+        tar \
+        # Provides 'su', required by Azure DevOps
+        util-linux \
+    && dnf clean all
+
+COPY --from=runtime /usr/share/dotnet /usr/share/dotnet
+COPY --from=powershell /powershell /usr/share/powershell
+RUN ln -s /usr/share/dotnet/dotnet /usr/bin/dotnet && \
+    ln -s /usr/share/powershell/pwsh /usr/bin/pwsh && \
+    ln -sf /usr/bin/node-24 /usr/bin/node && \
+    ln -sf /usr/bin/npm-24 /usr/bin/npm
@@ -0,0 +1,40 @@
+ARG ROOTFS_DIR=/crossrootfs/x64
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-builder-amd64 AS builder
+ARG ROOTFS_DIR
+
+RUN SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt /scripts/eng/common/cross/build-rootfs.sh x64 alpine3.17 --skipunmount --skipemulation
+
+RUN TARGET_TRIPLE="x86_64-alpine-linux-musl" && \
+    GCC_VER=$(basename "$(find "$ROOTFS_DIR/usr/include/c++/" -mindepth 1 -maxdepth 1 -type d | sort -V | head -n1)") && \
+    CPP_INCLUDES="$ROOTFS_DIR/usr/include/c++/$GCC_VER" && \
+    TRIPLET_INCLUDES=$([ -e "$CPP_INCLUDES/$TARGET_TRIPLE" ] && echo "$CPP_INCLUDES/$TARGET_TRIPLE" || echo "$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE");$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE/c++/$GCC_VER")") && \
+    echo "Using C++ includes $CPP_INCLUDES and $TRIPLET_INCLUDES to build for $TARGET_TRIPLE" && \
+    cmake -S llvm-project.src/runtimes -B runtimes \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_COMPILER=clang \
+        -DCMAKE_C_COMPILER=clang \
+        -DCMAKE_CXX_COMPILER=clang++ \
+        -DCMAKE_ASM_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_C_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_CXX_COMPILER_TARGET="$TARGET_TRIPLE" \
+        # We're going to link the static libraries we build here into PIC images, so build the static libraries as PIC.
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DCMAKE_SYSROOT="$ROOTFS_DIR" \
+        # Specify linker to use for exes directly for CMake toolchain detection
+        -DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
+        # Don't search for tools in the sysroot as we're cross-compiling
+        -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM="NEVER" \
+        -DLLVM_USE_LINKER=lld \
+        -DLLVM_ENABLE_RUNTIMES="libcxx" \
+        -DLIBCXX_ENABLE_SHARED=OFF \
+        -DLIBCXX_HAS_MUSL_LIBC=ON \
+        -DLIBCXX_CXX_ABI=libstdc++ \
+        -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$CPP_INCLUDES;$TRIPLET_INCLUDES" && \
+    cmake --build runtimes -j $(getconf _NPROCESSORS_ONLN) && \
+    cmake --install runtimes --prefix "$ROOTFS_DIR/usr"
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-llvm-amd64
+ARG ROOTFS_DIR
+
+COPY --from=builder $ROOTFS_DIR $ROOTFS_DIR
@@ -0,0 +1,54 @@
+ARG ROOTFS_DIR=/crossrootfs/x64
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-builder-amd64 AS builder
+ARG ROOTFS_DIR
+
+# Use Ubuntu Bionic as the base image for the rootfs
+# to get a new enough libstdc++ for the sanitizer runtimes and instrumentation.
+RUN PYTHON_EXECUTABLE="$ROOTFS_PIP_HOME/bin/python" /scripts/eng/common/cross/build-rootfs.sh x64 bionic --skipunmount --skipemulation
+
+RUN TARGET_TRIPLE="x86_64-linux-gnu" && \
+    GCC_VER=$(basename "$(find "$ROOTFS_DIR/usr/include/c++/" -mindepth 1 -maxdepth 1 -type d | sort -V | head -n1)") && \
+    CPP_INCLUDES="$ROOTFS_DIR/usr/include/c++/$GCC_VER" && \
+    TRIPLET_INCLUDES=$([ -e "$CPP_INCLUDES/$TARGET_TRIPLE" ] && echo "$CPP_INCLUDES/$TARGET_TRIPLE" || echo "$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE");$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE/c++/$GCC_VER")") && \
+    echo "Using C++ includes $CPP_INCLUDES and $TRIPLET_INCLUDES to build for $TARGET_TRIPLE" && \
+    CLANG_MAJOR_VERSION=$(clang --version | grep -oP "(?<=version )\d+") && \
+    cmake -S llvm-project.src/runtimes -B runtimes \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_COMPILER=clang \
+        -DCMAKE_C_COMPILER=clang \
+        -DCMAKE_CXX_COMPILER=clang++ \
+        -DCMAKE_ASM_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_C_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_CXX_COMPILER_TARGET="$TARGET_TRIPLE" \
+        # We're going to link the static libraries we build here into PIC images, so build the static libraries as PIC.
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DCMAKE_SYSROOT="$ROOTFS_DIR" \
+        # Specify linker to use for exes directly for CMake toolchain detection
+        -DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
+        # Don't search for tools in the sysroot as we're cross-compiling
+        -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM="NEVER" \
+        -DLLVM_USE_LINKER=lld \
+        -DLLVM_ENABLE_RUNTIMES="compiler-rt;libcxx" \
+        -DLIBCXX_ENABLE_SHARED=OFF \
+        -DLIBCXX_CXX_ABI="libstdc++" \
+        -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$CPP_INCLUDES;$TRIPLET_INCLUDES" \
+        -DCOMPILER_RT_CXX_LIBRARY="libcxx" \
+        -DCOMPILER_RT_STATIC_CXX_LIBRARY=ON \
+        -DSANITIZER_CXX_ABI_LIBNAME="libstdc++" \
+        -DCOMPILER_RT_BUILD_MEMPROF=OFF \
+        # The libfuzzer build in LLVM doesn't correctly forward the required CMake properties to the "fuzzed libc++" build
+        # so skip it here.
+        -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \
+        -DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON \
+        # Work around error building rtsan (this enables all sanitizers but rtsan)
+        -DCOMPILER_RT_SANITIZERS_TO_BUILD="asan;dfsan;msan;hwasan;tsan;safestack;cfi;scudo_standalone;ubsan_minimal;gwp_asan;nsan;asan_abi" \
+        -DCOMPILER_RT_INSTALL_PATH="/usr/local/lib/clang/$CLANG_MAJOR_VERSION" && \
+    cmake --build runtimes -j && \
+    cmake --install runtimes --prefix "$ROOTFS_DIR/usr"
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-llvm-amd64
+ARG ROOTFS_DIR
+
+COPY --from=builder /usr/local/lib/clang /usr/local/lib/clang
+COPY --from=builder $ROOTFS_DIR $ROOTFS_DIR
@@ -0,0 +1,49 @@
+ARG ROOTFS_DIR=/crossrootfs/x64
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-builder-amd64 AS builder
+ARG ROOTFS_DIR
+
+RUN PYTHON_EXECUTABLE="$ROOTFS_PIP_HOME/bin/python" /scripts/eng/common/cross/build-rootfs.sh x64 bionic --skipunmount --skipemulation
+
+RUN TARGET_TRIPLE="x86_64-linux-gnu" && \
+    GCC_VER=$(basename "$(find "$ROOTFS_DIR/usr/include/c++/" -mindepth 1 -maxdepth 1 -type d | sort -V | head -n1)") && \
+    CPP_INCLUDES="$ROOTFS_DIR/usr/include/c++/$GCC_VER" && \
+    TRIPLET_INCLUDES=$([ -e "$CPP_INCLUDES/$TARGET_TRIPLE" ] && echo "$CPP_INCLUDES/$TARGET_TRIPLE" || echo "$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE");$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE/c++/$GCC_VER")") && \
+    CLANG_MAJOR_VERSION=$(clang --version | grep -oP "(?<=version )\d+") && \
+    cmake -S llvm-project.src/runtimes -B runtimes \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_COMPILER=clang \
+        -DCMAKE_C_COMPILER=clang \
+        -DCMAKE_CXX_COMPILER=clang++ \
+        -DCMAKE_ASM_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_C_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_CXX_COMPILER_TARGET="$TARGET_TRIPLE" \
+        # We're going to link the static libraries we build here into PIC images, so build the static libraries as PIC.
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DCMAKE_SYSROOT="$ROOTFS_DIR" \
+        # Specify linker to use for exes directly for CMake toolchain detection
+        -DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
+        # Don't search for tools in the sysroot as we're cross-compiling
+        -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM="NEVER" \
+        -DLLVM_USE_LINKER=lld \
+        -DLLVM_ENABLE_RUNTIMES="libcxx;compiler-rt" \
+        -DLIBCXX_ENABLE_SHARED=OFF \
+        -DLIBCXX_CXX_ABI=libstdc++ \
+        -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$CPP_INCLUDES;$TRIPLET_INCLUDES" \
+        -DCOMPILER_RT_CXX_LIBRARY="libcxx" \
+        -DCOMPILER_RT_STATIC_CXX_LIBRARY=ON \
+        -DCOMPILER_RT_BUILD_SANITIZERS=OFF \
+        -DCOMPILER_RT_BUILD_MEMPROF=OFF \
+        # The libfuzzer build in LLVM doesn't correctly forward the required CMake properties to the "fuzzed libc++" build
+        # so skip it here.
+        -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \
+        -DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON \
+        -DCOMPILER_RT_INSTALL_PATH="/usr/local/lib/clang/$CLANG_MAJOR_VERSION" && \
+    cmake --build runtimes -j $(getconf _NPROCESSORS_ONLN) && \
+    cmake --install runtimes --prefix "$ROOTFS_DIR/usr"
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-llvm-amd64
+ARG ROOTFS_DIR
+
+COPY --from=builder /usr/local/lib/clang /usr/local/lib/clang/
+COPY --from=builder $ROOTFS_DIR $ROOTFS_DIR
@@ -0,0 +1,6 @@
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-cross-amd64 AS crossrootx64
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-android-amd64
+
+# Copy crossrootfs from AMD64 build image, so we can build Android-targeting code for that arch
+COPY --from=crossrootx64 /crossrootfs/x64 /crossrootfs/x64
@@ -0,0 +1,10 @@
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-cross-android-amd64
+
+# Copy the OpenSSL headers and libs from the x64 rootfs into the Anroid NDK so dotnet/runtime's
+# OpenSSL headers hack can find them for the linux-bionic build.
+RUN mkdir -p ${ANDROID_NDK_ROOT}/usr/local/include && \
+    mkdir ${ANDROID_NDK_ROOT}/usr/local/lib && \
+    cp -r /crossrootfs/x64/usr/include/openssl  ${ANDROID_NDK_ROOT}/usr/local/include/openssl && \
+    cp -r /crossrootfs/x64/usr/include/x86_64-linux-gnu/openssl  ${ANDROID_NDK_ROOT}/usr/local/include && \
+    cp -r $(readlink -f /crossrootfs/x64/usr/lib/x86_64-linux-gnu/libssl.so)  ${ANDROID_NDK_ROOT}/usr/local/lib/libssl.so && \
+    cp -r $(readlink -f /crossrootfs/x64/usr/lib/x86_64-linux-gnu/libcrypto.so)  ${ANDROID_NDK_ROOT}/usr/local/lib/libcrypto.so
@@ -0,0 +1,40 @@
+ARG ROOTFS_DIR=/crossrootfs/arm
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-builder-amd64 AS builder
+ARG ROOTFS_DIR
+
+RUN SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt /scripts/eng/common/cross/build-rootfs.sh arm alpine3.17 --skipunmount --skipemulation
+
+RUN TARGET_TRIPLE="armv7-alpine-linux-musleabihf" && \
+    GCC_VER=$(basename "$(find "$ROOTFS_DIR/usr/include/c++/" -mindepth 1 -maxdepth 1 -type d | sort -V | head -n1)") && \
+    CPP_INCLUDES="$ROOTFS_DIR/usr/include/c++/$GCC_VER" && \
+    TRIPLET_INCLUDES=$([ -e "$CPP_INCLUDES/$TARGET_TRIPLE" ] && echo "$CPP_INCLUDES/$TARGET_TRIPLE" || echo "$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE");$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE/c++/$GCC_VER")") && \
+    echo "Using C++ includes $CPP_INCLUDES and $TRIPLET_INCLUDES to build for $TARGET_TRIPLE" && \
+    cmake -S llvm-project.src/runtimes -B runtimes \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_COMPILER=clang \
+        -DCMAKE_C_COMPILER=clang \
+        -DCMAKE_CXX_COMPILER=clang++ \
+        -DCMAKE_ASM_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_C_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_CXX_COMPILER_TARGET="$TARGET_TRIPLE" \
+        # We're going to link the static libraries we build here into PIC images, so build the static libraries as PIC.
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DCMAKE_SYSROOT="$ROOTFS_DIR" \
+        # Specify linker to use for exes directly for CMake toolchain detection
+        -DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
+        # Don't search for tools in the sysroot as we're cross-compiling
+        -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM="NEVER" \
+        -DLLVM_USE_LINKER=lld \
+        -DLLVM_ENABLE_RUNTIMES="libcxx" \
+        -DLIBCXX_ENABLE_SHARED=OFF \
+        -DLIBCXX_HAS_MUSL_LIBC=ON \
+        -DLIBCXX_CXX_ABI=libstdc++ \
+        -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$CPP_INCLUDES;$TRIPLET_INCLUDES" && \
+    cmake --build runtimes -j $(getconf _NPROCESSORS_ONLN) && \
+    cmake --install runtimes --prefix "$ROOTFS_DIR/usr"
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-llvm-amd64
+ARG ROOTFS_DIR
+
+COPY --from=builder $ROOTFS_DIR $ROOTFS_DIR
@@ -0,0 +1,52 @@
+ARG ROOTFS_DIR=/crossrootfs/arm
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-builder-amd64 AS builder
+ARG ROOTFS_DIR
+
+# The arm rootfs targets Ubuntu 22.04, which is the first version with a
+# glibc that supports 64-bit time_t. See https://github.com/dotnet/core/discussions/9285.
+RUN PYTHON_EXECUTABLE="$ROOTFS_PIP_HOME/bin/python" /scripts/eng/common/cross/build-rootfs.sh arm jammy no-lldb --skipunmount --skipemulation
+
+RUN TARGET_TRIPLE="arm-linux-gnueabihf" && \
+    GCC_VER=$(basename "$(find "$ROOTFS_DIR/usr/include/c++/" -mindepth 1 -maxdepth 1 -type d | sort -V | head -n1)") && \
+    CPP_INCLUDES="$ROOTFS_DIR/usr/include/c++/$GCC_VER" && \
+    TRIPLET_INCLUDES=$([ -e "$CPP_INCLUDES/$TARGET_TRIPLE" ] && echo "$CPP_INCLUDES/$TARGET_TRIPLE" || echo "$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE");$(realpath "$CPP_INCLUDES/../../$TARGET_TRIPLE/c++/$GCC_VER")") && \
+    echo "Using C++ includes $CPP_INCLUDES and $TRIPLET_INCLUDES to build for $TARGET_TRIPLE" && \
+    CLANG_MAJOR_VERSION=$(clang --version | grep -oP "(?<=version )\d+") && \
+    cmake -S llvm-project.src/runtimes -B runtimes \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_ASM_COMPILER=clang \
+        -DCMAKE_C_COMPILER=clang \
+        -DCMAKE_CXX_COMPILER=clang++ \
+        -DCMAKE_ASM_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_C_COMPILER_TARGET="$TARGET_TRIPLE" \
+        -DCMAKE_CXX_COMPILER_TARGET="$TARGET_TRIPLE" \
+        # We're going to link the static libraries we build here into PIC images, so build the static libraries as PIC.
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DCMAKE_SYSROOT="$ROOTFS_DIR" \
+        # Specify linker to use for exes directly for CMake toolchain detection
+        -DCMAKE_EXE_LINKER_FLAGS="-fuse-ld=lld" \
+        # Don't search for tools in the sysroot as we're cross-compiling
+        -DCMAKE_FIND_ROOT_PATH_MODE_PROGRAM="NEVER" \
+        -DLLVM_USE_LINKER=lld \
+        -DLLVM_ENABLE_RUNTIMES="libcxx;compiler-rt" \
+        -DLIBCXX_ENABLE_SHARED=OFF \
+        -DLIBCXX_CXX_ABI=libstdc++ \
+        -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$CPP_INCLUDES;$TRIPLET_INCLUDES" \
+        -DCOMPILER_RT_CXX_LIBRARY="libcxx" \
+        -DCOMPILER_RT_STATIC_CXX_LIBRARY=ON \
+        -DCOMPILER_RT_BUILD_SANITIZERS=OFF \
+        -DCOMPILER_RT_BUILD_MEMPROF=OFF \
+        # The libfuzzer build in LLVM doesn't correctly forward the required CMake properties to the "fuzzed libc++" build
+        # so skip it here.
+        -DCOMPILER_RT_BUILD_LIBFUZZER=OFF \
+        -DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON \
+        -DCOMPILER_RT_INSTALL_PATH="/usr/local/lib/clang/$CLANG_MAJOR_VERSION" && \
+    cmake --build runtimes -j $(getconf _NPROCESSORS_ONLN) && \
+    cmake --install runtimes --prefix "$ROOTFS_DIR/usr"
+
+FROM mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux-4.0-net11.0-crossdeps-llvm-amd64
+ARG ROOTFS_DIR
+
+COPY --from=builder /usr/local/lib/clang /usr/local/lib/clang/
+COPY --from=builder $ROOTFS_DIR $ROOTFS_DIR