diff --git a/third_party/edk2/BUILD.bazel b/third_party/edk2/BUILD.bazel
new file mode 100644
index 0000000..8511359
--- /dev/null
+++ b/third_party/edk2/BUILD.bazel
@@ -0,0 +1,5 @@
+alias(
+    name = "firmware",
+    actual = "@edk2//:firmware",
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/edk2/external.bzl b/third_party/edk2/external.bzl
new file mode 100644
index 0000000..6bb7325
--- /dev/null
+++ b/third_party/edk2/external.bzl
@@ -0,0 +1,27 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "new_git_repository")
+
+def edk2_external(name):
+    new_git_repository(
+        name = name,
+        build_file = "//third_party/edk2/external:BUILD.repo",
+        commit = "37eef91017ad042035090cae46557f9d6e2d5917",
+        init_submodules = True,
+        remote = "https://github.com/tianocore/edk2",
+        shallow_since = "1567048229 +0800",
+    )
diff --git a/third_party/edk2/external/BUILD b/third_party/edk2/external/BUILD
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/edk2/external/BUILD
diff --git a/third_party/edk2/external/BUILD.repo b/third_party/edk2/external/BUILD.repo
new file mode 100644
index 0000000..7911678
--- /dev/null
+++ b/third_party/edk2/external/BUILD.repo
@@ -0,0 +1,22 @@
+genrule(
+    name = "firmware",
+    srcs = glob(["**"]),
+    outs = [
+        "OVMF_CODE.fd",
+        "OVMF_VARS.fd",
+    ],
+    cmd = """
+    (
+        # The edk2 build does not like Bazel's default genrule environment.
+        set +u
+
+        cd external/edk2
+        . edksetup.sh
+        make -C BaseTools/Source/C
+        build -DTPM2_ENABLE -DSECURE_BOOT_ENABLE -t GCC5 -a X64 -b RELEASE -p $$PWD/OvmfPkg/OvmfPkgX64.dsc
+    ) > /dev/null
+
+    cp external/edk2/Build/OvmfX64/RELEASE_GCC5/FV/{OVMF_CODE.fd,OVMF_VARS.fd} $(RULEDIR)
+    """,
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/kubernetes/BUILD.bazel b/third_party/kubernetes/BUILD.bazel
new file mode 100644
index 0000000..4b366ba
--- /dev/null
+++ b/third_party/kubernetes/BUILD.bazel
@@ -0,0 +1,5 @@
+alias(
+    name = "kubectl",
+    actual = "@kubernetes//cmd/kubectl",
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/kubernetes/external.bzl b/third_party/kubernetes/external.bzl
new file mode 100644
index 0000000..77d7af2
--- /dev/null
+++ b/third_party/kubernetes/external.bzl
@@ -0,0 +1,31 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def kubernetes_external(name, version):
+    sums = {
+        "1.16.4": "3a49373ba56c73c282deb0cfa2ec7bfcc6bf46acb6992f01319eb703cbf68996",
+    }
+    http_archive(
+        name = name,
+        patch_args = ["-p1"],
+        patches = [
+            "//third_party/kubernetes/external:0001-avoid-unexpected-keyword-error-by-using-positional-p.patch",
+        ],
+        sha256 = sums[version],
+        urls = ["https://dl.k8s.io/v%s/kubernetes-src.tar.gz" % version],
+    )
diff --git a/third_party/kubernetes/external/0001-avoid-unexpected-keyword-error-by-using-positional-p.patch b/third_party/kubernetes/external/0001-avoid-unexpected-keyword-error-by-using-positional-p.patch
new file mode 100644
index 0000000..5223bee
--- /dev/null
+++ b/third_party/kubernetes/external/0001-avoid-unexpected-keyword-error-by-using-positional-p.patch
@@ -0,0 +1,47 @@
+Copyright 2020 The Monogon Project Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+From d73ca1c4da53336442d2d256e70ce2acc45e4275 Mon Sep 17 00:00:00 2001
+From: Mostyn Bramley-Moore <mostynb@vewd.com>
+Date: Thu, 17 Oct 2019 14:00:18 +0200
+Subject: [PATCH] avoid unexpected keyword error by using positional parameters
+
+This avoids the following error, when building with bazel 1.0:
+...
+	File "/home/user/kubernetes/build/code_generation.bzl", line 44, in go_pkg
+		pkg.replace("staging/src/", "vendor/", maxsplit ...)
+unexpected keyword 'maxsplit', for call to method replace(old, new, maxsplit = None) of 'string'
+
+Fixes #81382
+---
+ build/code_generation.bzl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/build/code_generation.bzl b/build/code_generation.bzl
+index eed223eb86..6feef4ba6e 100644
+--- a/build/code_generation.bzl
++++ b/build/code_generation.bzl
+@@ -41,7 +41,7 @@ def go_pkg(pkg):
+         ...
+     )
+     """
+-    return go_prefix + "/" + pkg.replace("staging/src/", "vendor/", maxsplit = 1)
++    return go_prefix + "/" + pkg.replace("staging/src/", "vendor/", 1)
+ 
+ def openapi_deps():
+     deps = [
+-- 
+2.20.1
+
diff --git a/third_party/kubernetes/external/BUILD b/third_party/kubernetes/external/BUILD
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/kubernetes/external/BUILD
diff --git a/third_party/linux/external.bzl b/third_party/linux/external.bzl
new file mode 100644
index 0000000..5f25243
--- /dev/null
+++ b/third_party/linux/external.bzl
@@ -0,0 +1,35 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def linux_external(name, version):
+    sums = {
+        "5.4.7": "abc9b21d9146d95853dac35f4c4489a0199aff53ee6eee4b0563d1b37079fcc9",
+    }
+    http_archive(
+        name = name,
+        build_file = "//third_party/linux/external:BUILD.repo",
+        patch_args = ["-p1"],
+        patches = [
+            # Enable built-in cmdline for efistub
+            "//third_party/linux/external:0001-x86-Allow-built-in-command-line-to-work-in-early-ker.patch",
+        ],
+        sha256 = sums[version],
+        strip_prefix = "linux-" + version,
+        urls = ["https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-%s.tar.xz" % version],
+    )
+
diff --git a/third_party/musl/BUILD.bazel b/third_party/musl/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/musl/BUILD.bazel
diff --git a/third_party/musl/external.bzl b/third_party/musl/external.bzl
new file mode 100644
index 0000000..b9b4f83
--- /dev/null
+++ b/third_party/musl/external.bzl
@@ -0,0 +1,32 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def musl_external(name, version):
+    sums = {
+        "1.1.24": "1370c9a812b2cf2a7d92802510cca0058cc37e66a7bedd70051f0a34015022a3"
+    }
+    all_content = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+
+    http_archive(
+        name = name,
+        build_file_content = all_content,
+        sha256 = sums[version],
+        strip_prefix = "musl-" + version,
+        urls = ["https://www.musl-libc.org/releases/musl-%s.tar.gz" % version],
+    )
+
diff --git a/third_party/util-linux/BUILD.bazel b/third_party/util-linux/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/util-linux/BUILD.bazel
diff --git a/third_party/util-linux/external.bzl b/third_party/util-linux/external.bzl
new file mode 100644
index 0000000..84b17ec
--- /dev/null
+++ b/third_party/util-linux/external.bzl
@@ -0,0 +1,32 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def util_linux_external(name, version):
+    sums = {
+        "2.34": "1d0c1a38f8c14a2c251681907203cccc78704f5702f2ef4b438bed08344242f7"
+    }
+    all_content = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+
+    http_archive(
+        name = name,
+        build_file_content = all_content,
+        sha256 = sums[version],
+        strip_prefix = "util-linux-" + version,
+        urls = ["https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/snapshot/util-linux-%s.tar.gz" % version],
+    )
+
diff --git a/third_party/xfsprogs/BUILD b/third_party/xfsprogs/BUILD
new file mode 100644
index 0000000..51301b7
--- /dev/null
+++ b/third_party/xfsprogs/BUILD
@@ -0,0 +1,86 @@
+# TODO(leo): I have not been able to figure out a clever way of separating this
+# into multiple rules, particularly musl, which hardcodes sandbox paths into its
+# toolchain such that a different rule cannot consume it.
+#
+# For now, using a single massive genrule is the least annoying way to do this.
+# As soon as we build more than just mkfs.xfs, we should re-visit this.
+#
+# Some possibilities:
+#
+#  - Build the musl toolchain in the build container and use native rules
+#    for headers_install and util_linux (they should, in theory, generate
+#    well-defined artifacts that we can use in the build).
+#
+#    This would use Bazel's toolchain definition mechanism to consume the
+#    external toolchain, and would be compatible with the native C rules.
+#
+#    Maybe we can even build the external toolchain inside Bazel somehow?
+#
+#  - Write a custom rule that handles the toolchain.
+#
+#  - Converting *everything* to native rules is probably not an option due
+#    to how complex the third party build systems we touch are.
+
+genrule(
+    name = "mkfs.extfs",
+    srcs = [
+        "@xfsprogs//:all",
+        "@musl//:all",
+        "@util_linux//:all",
+        "@linux//:all",
+    ],
+    outs = [
+        "mkfs.xfs",
+    ],
+    cmd = """
+    MUSL=$$PWD/$(RULEDIR)/musl_prefix
+
+    echo "Compiling and installing musl..."
+    (
+        cd external/musl
+        ./configure --prefix=$$MUSL --syslibdir=$$MUSL/lib
+        make -j $$(nproc) install
+    ) > /dev/null
+
+    echo "Installing Linux kernel headers..."
+    (
+        cd external/linux
+        make headers_install ARCH=x86_64 INSTALL_HDR_PATH=$$MUSL
+    ) > /dev/null
+
+    echo "Compiling util_linux..."
+    (
+        cd external/util_linux
+        ./autogen.sh
+        ./configure \
+        CC="$$MUSL/bin/musl-gcc" \
+        --without-systemd \
+        --without-udev \
+        --without-btrfs \
+        --disable-pylibmount \
+        --without-tinfo \
+        --prefix=$$MUSL \
+        --disable-makeinstall-chown \
+        --disable-makeinstall-setuid \
+        --with-bashcompletiondir=$$MUSL/usr/share/bash-completion
+        make -j $$(nproc) libuuid.la libblkid.la
+        echo "Installing util_linux..."
+        cp -v .libs/* $$MUSL/lib/
+        mkdir -p $$MUSL/include/{uuid,blkid}
+        cp libuuid/src/uuid.h $$MUSL/include/uuid/
+        cp libblkid/src/blkid.h $$MUSL/include/blkid/
+    ) > /dev/null
+
+    echo "Compiling mkfs.xfs..."
+    (
+        cd external/xfsprogs
+        make configure
+        ./configure CC="$$MUSL/bin/musl-gcc" CFLAGS="-static" --prefix=$$MUSL
+        echo COMPILERING
+        make mkfs -j8
+    ) > /dev/null
+
+    cp external/xfsprogs/mkfs/mkfs.xfs $(RULEDIR)
+    """,
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/xfsprogs/external.bzl b/third_party/xfsprogs/external.bzl
new file mode 100644
index 0000000..7318df4
--- /dev/null
+++ b/third_party/xfsprogs/external.bzl
@@ -0,0 +1,35 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def xfsprogs_external(name, version):
+    sums = {
+        "5.2.1": "6187f25f1744d1ecbb028b0ea210ad586d0f2dae24e258e4688c67740cc861ef",
+    }
+    all_content = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+
+    http_archive(
+        name = name,
+        build_file_content = all_content,
+        patch_args = ["-p1"],
+        patches = [
+            "//third_party/xfsprogs/external:0001-Fixes-for-static-compilation.patch",
+        ],
+        sha256 = sums[version],
+        strip_prefix = "xfsprogs-dev-" + version,
+        urls = ["https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/snapshot/xfsprogs-dev-%s.tar.gz" % version],
+    )
diff --git a/third_party/xfsprogs/external/0001-Fixes-for-static-compilation.patch b/third_party/xfsprogs/external/0001-Fixes-for-static-compilation.patch
new file mode 100644
index 0000000..14dd4cd
--- /dev/null
+++ b/third_party/xfsprogs/external/0001-Fixes-for-static-compilation.patch
@@ -0,0 +1,64 @@
+Copyright 2020 The Monogon Project Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+From 780a94ddc5c50bded264bfc0dbfffdb4182cdc51 Mon Sep 17 00:00:00 2001
+From: Lorenz Brun <lorenz@nexantic.com>
+Date: Mon, 9 Sep 2019 15:56:42 +0200
+Subject: [PATCH] Fixes for static compilation
+
+---
+ include/xfs.h | 6 +++---
+ mkfs/Makefile | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/include/xfs.h b/include/xfs.h
+index f2f675df..73687a16 100644
+--- a/include/xfs.h
++++ b/include/xfs.h
+@@ -6,7 +6,7 @@
+ #define __XFS_H__
+ 
+ #if defined(__linux__)
+-#include <xfs/linux.h>
++#include "linux.h"
+ #else
+ # error unknown platform... have fun porting!
+ #endif
+@@ -34,7 +34,7 @@ extern int xfs_assert_largefile[sizeof(off_t)-8];
+ #define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
+ #endif
+ 
+-#include <xfs/xfs_types.h>
+-#include <xfs/xfs_fs.h>
++#include "xfs_types.h"
++#include "xfs_fs.h"
+ 
+ #endif	/* __XFS_H__ */
+diff --git a/mkfs/Makefile b/mkfs/Makefile
+index 31482b08..57fb355d 100644
+--- a/mkfs/Makefile
++++ b/mkfs/Makefile
+@@ -13,7 +13,7 @@ CFILES = proto.c xfs_mkfs.c
+ LLDLIBS += $(LIBXFS) $(LIBXCMD) $(LIBFROG) $(LIBRT) $(LIBPTHREAD) $(LIBBLKID) \
+ 	$(LIBUUID)
+ LTDEPENDENCIES += $(LIBXFS) $(LIBXCMD) $(LIBFROG)
+-LLDFLAGS = -static-libtool-libs
++LLDFLAGS = -all-static
+ 
+ default: depend $(LTCOMMAND)
+ 
+-- 
+2.20.1
+
diff --git a/third_party/xfsprogs/external/BUILD b/third_party/xfsprogs/external/BUILD
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/xfsprogs/external/BUILD