I actually really like how debos handles this - unfortunately when I went down the road of trying to get it working for my setup I couldn't get it to complete the debootstrap process (I admittedly didn't spend too much time trying to get this working - my suspicion was that it had to do with kernel support on my build agent).

I hit the same roadblock with qemu-debootstrap, which is a great wrapper for this use case, but makes (to be fair, reasonable) assumptions about permissions you do and do not have that might not apply in a build agent where you don't have control of the kernel.

Separating the process out into two stages helped with this as I was manually able to perform only the mounts needed to get a minimal filesystem produced.

Not to plug but I wrote another article that explains the context in which I'm producing the builds and goes into more details about the constraints (https://headmelted.com/continuous-delivery-with-azure-pipeli...).

All that said, debos is a great tool if it fits your situation (as is qemu-debootstrap!)

I'd rather use debootstrap, it's been the standard for decades.