We have built something very similar to what you are describing: https://github.com/chainguard-dev/apko