diff --git a/containers/Makefile b/containers/Makefile
new file mode 100644
index 00000000..423a65f3
--- /dev/null
+++ b/containers/Makefile
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Disable built-in rules and variables
+MAKEFLAGS += -rR
+
+PODMAN := $(shell command -v podman)
+
+COREBOOT_REPO := https://github.com/coreboot/coreboot.git
+COREBOOT_COMMIT := 4.21
+
+SDCC_REPO := https://svn.code.sf.net/p/sdcc/code
+# Last rev to trunk before tagging 4.3.3
+SDCC_REV := 14376
+
+RUST_TOOLCHAIN := nightly-2023-09-07
+
+.PHONY: firmware-open
+firmware-open:
+	$(PODMAN) build \
+		--tag system76/$@:latest \
+		--build-arg=COREBOOT_REPO="$(COREBOOT_REPO)" \
+		--build-arg=COREBOOT_COMMIT="$(COREBOOT_COMMIT)" \
+		--build-arg=SDCC_REPO="$(SDCC_REPO)" \
+		--build-arg=SDCC_REV="$(SDCC_REV)" \
+		--build-arg=RUST_TOOLCHAIN="$(RUST_TOOLCHAIN)" \
+		--file Containerfile \
+		$@
diff --git a/containers/firmware-open/Containerfile b/containers/firmware-open/Containerfile
new file mode 100644
index 00000000..f28aa91a
--- /dev/null
+++ b/containers/firmware-open/Containerfile
@@ -0,0 +1,124 @@
+# Container for building System76 Open Firmware
+
+ARG CONTAINER_IMAGE="debian:12.2"
+
+# Build coreboot toolchain tools
+FROM ${CONTAINER_IMAGE} as crossgcc-build
+ARG COREBOOT_COMMIT
+ARG COREBOOT_REPO
+WORKDIR /tmp
+
+RUN apt-get --quiet update && \
+    apt-get --quiet install --no-install-recommends --assume-yes \
+        bash \
+        bison \
+        bzip2 \
+        ca-certificates \
+        curl \
+        flex \
+        g++ \
+        gcc \
+        git \
+        gnat \
+        libssl-dev \
+        m4 \
+        make \
+        patch \
+        pkgconf \
+        python-is-python3 \
+        python3 \
+        tar \
+        xz-utils \
+        zlib1g-dev && \
+    apt-get clean
+
+RUN git clone ${COREBOOT_REPO} && \
+    cd coreboot && \
+    git checkout ${COREBOOT_COMMIT}
+
+RUN make -C coreboot CPUS=$(nproc) BUILD_LANGUAGES=ada,c,c++ DEST=/opt/xgcc crossgcc-i386 && \
+    make -C coreboot CPUS=$(nproc) BUILD_LANGUAGES=ada,c,c++ DEST=/opt/xgcc crossgcc-x64 && \
+    rm -rf coreboot
+
+# Build SDCC
+FROM ${CONTAINER_IMAGE} as sdcc-build
+ARG SDCC_REPO
+ARG SDCC_REV
+WORKDIR /tmp
+
+RUN apt-get --quiet update && \
+    apt-get --quiet install --no-install-recommends --assume-yes \
+        autoconf \
+        automake \
+        bison \
+        ca-certificates \
+        flex \
+        g++ \
+        gcc \
+        libboost-dev \
+        make \
+        subversion \
+        zlib1g-dev && \
+    apt-get clean
+
+RUN svn checkout \
+    --depth infinity \
+    --revision ${SDCC_REV} \
+    ${SDCC_REPO}/trunk/sdcc \
+    sdcc
+
+# PIC requires gputils, which is not available on Alpine
+RUN cd sdcc && \
+    sh ./configure \
+        --disable-pic14-port \
+        --disable-pic16-port \
+        --disable-non-free \
+        --prefix= && \
+    make -j $(nproc) && \
+    make install DESTDIR=/opt/sdcc
+
+# Set up environment for building firmware-open
+FROM ${CONTAINER_IMAGE}
+ARG RUST_TOOLCHAIN
+COPY --from=crossgcc-build /opt/xgcc /opt/xgcc
+COPY --from=sdcc-build /opt/sdcc /opt/sdcc
+ENV COREBOOT_COMMIT "${COREBOOT_COMMIT}"
+ENV XGCCPATH "/opt/xgcc/bin"
+ENV SDCC_PATH "/opt/sdcc"
+ENV SDCC_REV "${SDCC_REV}"
+ENV PATH "${XGCCPATH}:${SDCC_PATH}/bin:$PATH"
+
+RUN apt-get --quiet update && \
+    apt-get --quiet install --no-install-recommends --assume-yes \
+        bash \
+        binutils \
+        ca-certificates \
+        ccache \
+        cmake \
+        curl \
+        dosfstools \
+        g++ \
+        gcc \
+        git \
+        git-lfs \
+        make \
+        mtools \
+        parted \
+        python-is-python3 \
+        python3 \
+        udev \
+        uuid-dev \
+        xxd \
+    && apt-get clean
+
+RUN curl --proto '=https' --tlsv1.3 -sSf https://sh.rustup.rs \
+        | sh -s -- -y --profile minimal --default-toolchain stable && \
+    . ~/.cargo/env && \
+    rustup toolchain install \
+        --no-self-update \
+        --profile minimal \
+        --component clippy,rust-src,rustfmt \
+        ${RUST_TOOLCHAIN}
+
+WORKDIR /workspace
+CMD ["bash"]