feat(build): containerize ISO builds for non-pacman distros

this is a commit message. it is a MANIFESTO for no reason. i am aware.
it is 17:38. i am in pain. the pain is optional. the commit is not.

so. context, because i know you need it:
i installed gentoo to see what happens. what happened: emerge. days of
emerge. portage asked me to rebuild itself mid-rebuild and i said yes
because i was scared of what it'd do if i said no. my ext4 drive died
AGAIN so we're btrfs. snapshots are now my emergency contacts.
(profile update pending: "Used Gentoo BTW" -> "Used Gentoo and it
used me")

THE ACTUAL CHANGES (finally):
- artools is bash + pacman. it is not sacred. it is now a CONTAINER
- Containerfile: artix base, artools + squashfs-tools + xorriso +
  mkinitcpio, repo buildiso as ENTRYPOINT (the --overwrite='*' one.
  the other one knows what it did), antergos-pkgs pacman.conf baked in
- .dockerignore so podman users don't download 33MB of my .git and
  learn things about me

devtmpfs requires rootful podman. i am not explaining why. the answer
is "devtmpfs is a coward." i am the maintainer. i am allowed to say
that. rootless? you're not building an ISO, you're building a support
system for your decisions. anyway.

- build-iso-podman.sh exists so i can stop pasting commands from the
  README into my own terminal like a tourist
- README now has: podman for non-pacman (gentoo fedora debian), native
  for arch/artix/kaos, and a TABLE. i made a TABLE. i am healing.
- it works on any distro with podman because i want you to suffer LESS
  than me. that is not altruism. it is spite with a benefit package.

so laugh all you want. forget about me all you want. but at least i'll
be gorgeous forever. this is the longest i've committed to anything
since gentoo. and i regret BOTH of those decisions.

Signed-off-by: Michał <ash8820@proton.me>

.dockerignore

@@ -0,0 +1,4 @@
+.git
+.iso
+iso-output
+docs/_site

Containerfile

@@ -0,0 +1,56 @@
+# Antergos NeXT ISO build container
+#
+# Build an Antergos NeXT ISO inside an Artix Linux container. This is the
+# same path GitHub Actions uses, so anyone can produce a release ISO without
+# running an Artix/Arch system (works on Gentoo, Fedora, anything with podman).
+#
+# Usage:
+#   podman build -t antergos-build .
+#   podman run --rm --privileged \
+#     -v /var/lib/artools-buildiso:/var/lib/artools/buildiso \
+#     -v "$(pwd)/iso-output:/workspace/iso-output" \
+#     -e WORKSPACE_DIR=/workspace \
+#     antergos-build
+#
+# --privileged is required: artools' chroot (via basestrap) mounts devtmpfs,
+# proc and sysfs into the target, which rootless containers cannot do.
+#
+# The finished ISO is written to /workspace/iso-output (bind-mounted above).
+
+FROM docker.io/artixlinux/artixlinux:base
+
+ENV INITSYS=dinit \
+    WORKSPACE_DIR=/workspace \
+    CHROOTS_DIR=/var/lib/artools
+
+# Full dependency set for an ISO build: artools (base + iso tools), squashfs
+# for the .sfs layers, mkinitcpio for the initramfs, grub + xorriso for the
+# bootable image, git/python for CI tooling and the Internet Archive uploader.
+RUN pacman -Syu --noconfirm --needed --overwrite='*' \
+      artools \
+      git \
+      squashfs-tools \
+      sudo \
+      python \
+      python-pip \
+      xorriso \
+      dosfstools \
+      syslinux \
+      gptfdisk \
+      mtools
+
+# This repo's buildiso and profiles become the default build payload. Mounting
+# a live checkout over /workspace at runtime replaces these with the user's copy.
+WORKDIR /workspace
+COPY . .
+
+# Point artools at the Antergos package repository. CI copies the profile's
+# pacman.conf into both the user config dir (first match) and artools' defaults.
+RUN mkdir -p /root/.config/artools/pacman.conf.d \
+    && cp pacman.conf.d/iso-x86_64.conf /root/.config/artools/pacman.conf.d/iso-x86_64.conf \
+    && cp pacman.conf.d/iso-x86_64.conf /usr/share/artools/pacman.conf.d/iso-x86_64.conf
+
+# The modified buildiso lives in this repo and must be used instead of
+# /usr/bin/buildiso (which lacks --overwrite='*').
+ENTRYPOINT ["/workspace/buildiso"]
+CMD ["-p", "antergos"]

README.md

@@ -31,13 +31,57 @@ The Antergos NeXT project prefers init system flexibility over systemd lock-in.
 
 ## Building
 
-Requires an **Artix-based** system:
+### Option A: Build in a container (non-pacman distros — recommended)
+
+No Artix/Arch needed. Works on Gentoo, Fedora, Debian — anything **without
+pacman** that has podman. This is the same path GitHub Actions CI uses.
 
 ```bash
-# Install build deps
+# Build the image (installs artools + deps inside an Artix container)
+podman build -t antergos-build .
+
+# Build the ISO (rootful podman required — artools chroots mount devtmpfs,
+# which rootless containers cannot do)
+sudo podman run --rm --privileged \
+  -v /var/lib/artools-buildiso:/var/lib/artools/buildiso \
+  -v "$(pwd)/iso-output:/workspace/iso-output" \
+  -e WORKSPACE_DIR=/workspace \
+  antergos-build
+```
+
+Or use the helper script:
+
+```bash
+./build-iso-podman.sh
+```
+
+The finished `.iso` lands in `iso-output/`.
+
+### Option B: Native build (just pacman + artools)
+
+You do **not** need an Artix-based system — `buildiso` is plain bash on top of
+`pacman`. You need:
+
+- `pacman` (native on Arch/Artix/**KaOS**; on other distros, install it or
+  extract the `.pkg.tar.zst` files)
+- the artools libraries from the Artix repo: `artools-base` (provides
+  `basestrap`, `artix-chroot`, `fstabgen`) and `artools-iso` (provides
+  `buildiso`) plus their deps
+- `squashfs-tools`, `grub`, `xorriso`/`libisoburn`, `dosfstools`, `mtools`
+
+```bash
+# On Arch/Artix:
 pacman -S artools squashfs-tools
 modprobe loop
 
+# On KaOS (pacman native, but artools not in KaOS repos — extract from Artix):
+pacman -S squashfs-tools
+# grab artools-base/artools-iso from the Artix repo and extract over /
+
+# On other distros: grab the packages from the Artix repo and extract
+# them over / (e.g. into /usr/share/artools and /usr/bin), then install
+# pacman and the deps listed above.
+
 # Clone and enter
 git clone https://github.com/Antergos-NeXT/antergos-iso.git
 cd antergos-iso
@@ -59,6 +103,11 @@ The `.iso` appears in `/var/lib/artools/buildiso/iso/antergos/`.
 
 First build pulls ~5 GB from the internet. Subsequent builds use pacman cache.
 
+> **Which option do I use?**
+>
+> - **Arch / Artix / KaOS / any pacman-based distro** → Option B (native).
+> - **Anything else** (Gentoo, Fedora, Debian, ...) → Option A (podman).
+
 ### Custom packages
 
 The ISO pulls custom packages (branding, Calamares config, wallpapers) from our repo. Add it to your system:

build-iso-podman.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+
+# Antergos NeXT ISO build inside the Artix container (see Containerfile).
+# Rootful podman is required: artools' chroot mounts devtmpfs, which rootless
+# containers cannot do.
+
+cd "$(dirname "$0")"
+
+# 1. Ensure the build image exists
+if ! podman image exists localhost/antergos-build:latest; then
+  podman build -t antergos-build .
+fi
+
+# 2. Run the build (privileged, workspace mounted, tmpfs workdir, ISO exported)
+sudo podman run --rm --privileged \
+  -v "$(pwd):/workspace" \
+  -e WORKSPACE_DIR=/workspace \
+  -e INITSYS=dinit \
+  antergos-build sh -c '
+    set -euo pipefail
+    mkdir -p /var/lib/artools/buildiso
+    mount -t tmpfs -o size=12G,exec,suid,dev tmpfs /var/lib/artools/buildiso
+    /workspace/buildiso -p antergos
+    echo "=== BUILD FINISHED ==="
+    mkdir -p /workspace/iso-output
+    cp -a /var/lib/artools/buildiso/iso/antergos/. /workspace/iso-output/ 2>/dev/null || true
+    ls -la /workspace/iso-output/ | head -20
+  '