diff --git a/.github/workflows/.pkgs.yml b/.github/workflows/.pkgs.yml
index 69600d06..f07feac1 100644
--- a/.github/workflows/.pkgs.yml
+++ b/.github/workflows/.pkgs.yml
@@ -21,6 +21,9 @@ jobs:
         name: Set pkgs output
         id: set
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          # offload builds from a private source tree and is built from its own repo.
+          DISABLED_PACKAGES: offload
         with:
           script: |
             const fs = require('fs');
diff --git a/docker-bake.hcl b/docker-bake.hcl
index b9e77488..5ece703c 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -55,7 +55,8 @@ variable "PKGS_BASE" {
     "docker-cli",
     "docker-engine",
     "model",
-    "agent"
+    "agent",
+    "offload"
   ]
 }
 
@@ -91,6 +92,8 @@ variable "PKG_PLATFORMS_BASE" {
     model = ["darwin/amd64", "darwin/arm64", "linux/amd64", "linux/arm64", "linux/arm/v7", "windows/amd64", "windows/arm64"]
     # https://github.com/docker/docker-agent/blob/5b9feaabe743a5ad577f2247ed55d5dcb2678e8b/Taskfile.yml#L79
     agent = ["darwin/amd64", "darwin/arm64", "linux/amd64", "linux/arm64", "windows/amd64", "windows/arm64"]
+    # Linux packages only; darwin and windows ship through the source repo.
+    offload = ["linux/amd64", "linux/arm64"]
   }
 }
 
@@ -102,7 +105,8 @@ variable "PKG_PLATFORMS_EXTRA" {
 variable "PKG_DISTROS" {
   description = "Package-specific distro mapping. Packages omitted here build for all DISTROS."
   default = {
-    docker = ["static"]
+    docker  = ["static"]
+    offload = ["ubuntu2404", "ubuntu2604", "rockylinux8"]
   }
 }
 
@@ -211,6 +215,28 @@ variable "NIGHTLY_BUILD" {
   default = null
 }
 
+variable "VERSION" {
+  description = "Version to build, with v prefix, for example v0.7.52. Only used for the offload package, whose source tree is passed in as the src named context."
+  default = null
+}
+variable "COMMIT" {
+  description = "Short commit of the source tree. Only used for the offload package."
+  default = null
+}
+variable "BUILD" {
+  description = "Build number of the release build. Only used for the offload package."
+  default = null
+}
+variable "DATE" {
+  description = "Commit date of the release tag (YYYY-MM-DD). Only used for the offload package."
+  default = null
+}
+
+variable "PKG_BUILD_ENV_FILE" {
+  description = "File with build secrets, passed to the package build as the build-env secret. Only read by packages that mount it."
+  default = null
+}
+
 variable "GO_IMAGE" {
   description = "Go image to use for building packages."
   default = "golang"
@@ -693,6 +719,20 @@ target "_pkg-agent" {
   }
 }
 
+# The source repo is private, so there is no PKG_REPO/PKG_REF clone. The caller passes the
+# vendored source tree as the src named context, and builds are run from the source repo.
+target "_pkg-offload" {
+  args = {
+    PKG_NAME = PKG_NAME != null && PKG_NAME != "" ? PKG_NAME : "docker-offload-plugin"
+    GO_IMAGE_VARIANT = GO_IMAGE_VARIANT != null && GO_IMAGE_VARIANT != "" ? GO_IMAGE_VARIANT : "trixie"
+    PKG_DEB_EPOCH = PKG_DEB_EPOCH != null && PKG_DEB_EPOCH != "" ? PKG_DEB_EPOCH : ""
+    VERSION = VERSION
+    COMMIT = COMMIT
+    BUILD = BUILD
+    DATE = DATE
+  }
+}
+
 # Returns the list of supported platforms for a given package.
 function "pkgPlatforms" {
   params = [pkg]
@@ -760,7 +800,7 @@ target "pkg" {
   # BAKE_LOCAL_PLATFORM is a built-in var returning the current platform's
   # default platform specification: https://docs.docker.com/build/customize/bake/file-definition/#built-in-variables
   platforms = LOCAL_PLATFORM != null ? [BAKE_LOCAL_PLATFORM] : distroPlatforms(item.distro, item.pkg)
-  secret = distroSecrets(item.distro)
+  secret = concat(distroSecrets(item.distro), PKG_BUILD_ENV_FILE != null && PKG_BUILD_ENV_FILE != "" ? ["type=file,id=build-env,src=${PKG_BUILD_ENV_FILE}"] : [])
   attest = [
     "type=sbom",
     "type=provenance,mode=max"
diff --git a/pkg/offload/Dockerfile b/pkg/offload/Dockerfile
new file mode 100644
index 00000000..57dbddf0
--- /dev/null
+++ b/pkg/offload/Dockerfile
@@ -0,0 +1,117 @@
+# syntax=docker/dockerfile:1
+
+# Copyright 2026 Docker Packaging authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+ARG XX_VERSION="1.10.0"
+
+ARG DISTRO_NAME="debian13"
+ARG DISTRO_TYPE="deb"
+ARG DISTRO_RELEASE="debian"
+ARG DISTRO_SUITE="trixie"
+ARG DISTRO_ID="13"
+ARG DISTRO_IMAGE="debian:trixie"
+
+ARG PKG_NAME="docker-offload-plugin"
+
+ARG GO_IMAGE="golang"
+# Must be the exact Go version of the release build, so the package build reproduces it.
+ARG GO_VERSION="1.27.3"
+ARG GO_IMAGE_VARIANT="trixie"
+
+# stage used as named context that mounts hack/scripts
+# see pkg target in docker-bake.hcl
+FROM scratch AS scripts
+
+# The source tree is private and is passed in by the caller as the src named context, with
+# Go dependencies already vendored. There is no git clone fallback.
+FROM scratch AS src
+
+# cross compilation helper
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
+
+# go base image to retrieve /usr/local/go
+FROM ${GO_IMAGE}:${GO_VERSION}-${GO_IMAGE_VARIANT} AS go
+
+# deb
+FROM ${DISTRO_IMAGE} AS builder-deb
+COPY --from=xx / /
+ENV GOPATH="/go"
+ENV PATH="$PATH:/usr/local/go/bin:$GOPATH/bin"
+ENV GOTOOLCHAIN="local"
+ARG DISTRO_NAME
+RUN apt-get update && apt-get install -y --no-install-recommends apt-utils bash ca-certificates devscripts equivs
+COPY deb /root/package/debian
+ARG TARGETPLATFORM
+RUN mk-build-deps -t "xx-apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y" -i /root/package/debian/control
+WORKDIR /root/package
+ARG NIGHTLY_BUILD
+ARG VERSION
+ARG COMMIT
+ARG BUILD
+ARG DATE
+ARG DISTRO_RELEASE
+ARG DISTRO_ID
+ARG DISTRO_SUITE
+ARG PKG_NAME
+ARG PKG_PACKAGER
+ARG PKG_DEB_BUILDFLAGS
+ARG PKG_DEB_REVISION
+ARG PKG_DEB_EPOCH
+ARG SOURCE_DATE_EPOCH
+RUN --mount=type=bind,source=scripts/pkg-deb-build.sh,target=/usr/local/bin/pkg-deb-build \
+    --mount=type=bind,from=scripts,source=gen-deb-changelog.sh,target=/usr/local/bin/gen-deb-changelog \
+    --mount=type=bind,from=src,target=/root/package/offload,rw \
+    --mount=type=bind,from=go,source=/usr/local/go,target=/usr/local/go \
+    --mount=type=secret,id=build-env,target=/run/secrets/build-env \
+    OUTDIR=/out SRCDIR=./offload BUILD_ENV_FILE=/run/secrets/build-env pkg-deb-build
+
+# rpm
+FROM ${DISTRO_IMAGE} AS builder-rpm
+COPY --from=xx / /
+ENV GOPATH="/go"
+ENV PATH="$PATH:/usr/local/go/bin:$GOPATH/bin"
+ENV GOTOOLCHAIN="local"
+ARG DISTRO_NAME
+RUN --mount=type=bind,from=scripts,source=rpm-init.sh,target=/usr/local/bin/rpm-init \
+  rpm-init $DISTRO_NAME
+COPY rpm /root/rpmbuild/SPECS
+ARG TARGETPLATFORM
+RUN --mount=type=bind,from=scripts,source=rpm-builddep.sh,target=/usr/local/bin/rpm-builddep \
+  rpm-builddep $(xx-info rhel-arch) /root/rpmbuild/SPECS
+WORKDIR /root/rpmbuild
+ARG NIGHTLY_BUILD
+ARG VERSION
+ARG COMMIT
+ARG BUILD
+ARG DATE
+ARG DISTRO_RELEASE
+ARG DISTRO_ID
+ARG DISTRO_SUITE
+ARG PKG_NAME
+ARG PKG_PACKAGER
+ARG PKG_RPM_BUILDFLAGS
+ARG PKG_RPM_RELEASE
+ARG SOURCE_DATE_EPOCH
+RUN --mount=type=bind,source=scripts/pkg-rpm-build.sh,target=/usr/local/bin/pkg-rpm-build \
+    --mount=type=bind,from=src,target=/usr/local/src/offload,rw \
+    --mount=type=bind,from=go,source=/usr/local/go,target=/usr/local/go \
+    --mount=type=secret,id=build-env,target=/run/secrets/build-env \
+    OUTDIR=/out SRCDIR=/usr/local/src/offload BUILD_ENV_FILE=/run/secrets/build-env pkg-rpm-build
+
+FROM builder-${DISTRO_TYPE} AS build-pkg
+ARG BUILDKIT_SBOM_SCAN_STAGE=true
+
+FROM scratch AS pkg
+COPY --from=build-pkg /out /
diff --git a/pkg/offload/deb/control b/pkg/offload/deb/control
new file mode 100644
index 00000000..0cbf6312
--- /dev/null
+++ b/pkg/offload/deb/control
@@ -0,0 +1,16 @@
+Source: docker-offload-plugin
+Section: admin
+Priority: optional
+Maintainer: Docker <support@docker.com>
+Homepage: https://www.docker.com
+Standards-Version: 3.9.6
+Build-Depends: bash,
+               debhelper-compat (= 13),
+               make
+
+Package: docker-offload-plugin
+Priority: optional
+Architecture: linux-any
+Enhances: docker-ce-cli
+Description: Docker Offload plugin for the Docker CLI.
+Homepage: https://docs.docker.com/offload/
diff --git a/pkg/offload/deb/copyright b/pkg/offload/deb/copyright
new file mode 100644
index 00000000..d723d73b
--- /dev/null
+++ b/pkg/offload/deb/copyright
@@ -0,0 +1,8 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: docker-offload-plugin
+Source: https://docs.docker.com/offload/
+
+Files: *
+Copyright: Docker, Inc.
+License: Proprietary
+ All rights reserved.
diff --git a/pkg/offload/deb/rules b/pkg/offload/deb/rules
new file mode 100755
index 00000000..1113126e
--- /dev/null
+++ b/pkg/offload/deb/rules
@@ -0,0 +1,25 @@
+#!/usr/bin/make -f
+
+# force packages to be built with xz compression, as Ubuntu 21.10 and up use
+# zstd compression, which is non-standard, and breaks 'dpkg-sig --verify'
+override_dh_builddeb:
+	dh_builddeb -- -Zxz
+
+override_dh_auto_build:
+	make -C $(CURDIR)/offload ce-release VERSION=$(VERSION) COMMIT=$(COMMIT) BUILD=$(BUILD) DATE=$(DATE) BUILD_ENV_FILE=$(BUILD_ENV_FILE)
+
+override_dh_auto_test:
+	ver="$$($(CURDIR)/offload/dist/docker-offload docker-cli-plugin-metadata | awk '{ gsub(/[",:]/,"")}; $$1 == "Version" { print $$2 }')"; \
+		test "$$ver" = "$(VERSION)" && echo "PASS: docker-offload version OK" || (echo "FAIL: docker-offload version ($$ver) did not match $(VERSION)" && exit 1)
+
+# The build is reproducible, and the packaged binary is checked against the release
+# checksums, so do not strip or otherwise rewrite it after the build.
+override_dh_strip:
+
+override_dh_dwz:
+
+override_dh_auto_install:
+	install -D -p -m 0755 $(CURDIR)/offload/dist/docker-offload debian/docker-offload-plugin/usr/libexec/docker/cli-plugins/docker-offload
+
+%:
+	dh $@
diff --git a/pkg/offload/deb/source/format b/pkg/offload/deb/source/format
new file mode 100644
index 00000000..d3827e75
--- /dev/null
+++ b/pkg/offload/deb/source/format
@@ -0,0 +1 @@
+1.0
diff --git a/pkg/offload/rpm/docker-offload-plugin.spec b/pkg/offload/rpm/docker-offload-plugin.spec
new file mode 100644
index 00000000..1f3a1c88
--- /dev/null
+++ b/pkg/offload/rpm/docker-offload-plugin.spec
@@ -0,0 +1,40 @@
+%global debug_package %{nil}
+# The build is reproducible, and the packaged binary is checked against the release
+# checksums, so do not rewrite the ELF notes after the build.
+%global __brp_strip_comment_note %{nil}
+
+Name: docker-offload-plugin
+Version: %{_version}
+Release: %{_release}%{?dist}
+Epoch: 0
+Summary: Docker Offload plugin for the Docker CLI
+Group: Tools/Docker
+License: Proprietary
+URL: https://docs.docker.com/offload/
+Vendor: Docker
+Packager: Docker <support@docker.com>
+
+Enhances: docker-ce-cli
+
+BuildRequires: bash
+BuildRequires: make
+
+%description
+Docker Offload plugin for the Docker CLI.
+
+%prep
+
+%build
+make -C %{_srcdir} ce-release VERSION=%{_origversion} COMMIT=%{_commit} BUILD=%{_build} DATE=%{_date} BUILD_ENV_FILE=%{_buildenvfile}
+
+%check
+ver="$(%{_srcdir}/dist/docker-offload docker-cli-plugin-metadata | awk '{ gsub(/[",:]/,"")}; $1 == "Version" { print $2 }')"
+test "$ver" = "%{_origversion}" && echo "PASS: docker-offload version OK" || { echo "FAIL: docker-offload version ($ver) did not match %{_origversion}"; exit 1; }
+
+%install
+install -D -p -m 0755 %{_srcdir}/dist/docker-offload ${RPM_BUILD_ROOT}%{_libexecdir}/docker/cli-plugins/docker-offload
+
+%files
+%{_libexecdir}/docker/cli-plugins/docker-offload
+
+%changelog
diff --git a/pkg/offload/scripts/pkg-deb-build.sh b/pkg/offload/scripts/pkg-deb-build.sh
new file mode 100755
index 00000000..b196ab81
--- /dev/null
+++ b/pkg/offload/scripts/pkg-deb-build.sh
@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Docker Packaging authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+: "${NIGHTLY_BUILD=}"
+: "${VERSION=}"
+: "${COMMIT=}"
+: "${BUILD=}"
+: "${DATE=}"
+
+: "${DISTRO_NAME=}"
+: "${DISTRO_RELEASE=}"
+: "${DISTRO_ID=}"
+: "${DISTRO_SUITE=}"
+
+: "${PKG_NAME=}"
+: "${PKG_PACKAGER=}"
+: "${PKG_VENDOR=}"
+
+: "${PKG_DEB_REVISION=}"
+: "${PKG_DEB_EPOCH=}"
+
+: "${SOURCE_DATE_EPOCH=}"
+: "${SRCDIR=./offload}"
+: "${OUTDIR=/out}"
+: "${BUILD_ENV_FILE=}"
+
+set -e
+
+if [ -z "$VERSION" ]; then
+  echo >&2 "error: VERSION is required"
+  exit 1
+fi
+case "$VERSION" in
+  v*) ;;
+  *) echo >&2 "error: VERSION must start with v, got $VERSION"; exit 1 ;;
+esac
+if [ -z "$DISTRO_NAME" ]; then
+  echo >&2 "error: DISTRO_NAME is required"
+  exit 1
+fi
+if [ -z "$OUTDIR" ]; then
+  echo >&2 "error: OUTDIR is required"
+  exit 1
+fi
+if [ ! -f "${SRCDIR}/Makefile" ]; then
+  echo >&2 "error: no Makefile in ${SRCDIR}; pass the source tree as the src named context"
+  exit 1
+fi
+
+mkdir -p "$OUTDIR"
+
+if ! command -v xx-info &> /dev/null; then
+  echo >&2 "error: xx cross compilation helper is required"
+  exit 1
+fi
+
+# Derive deb-compatible package version from VERSION.
+# Nightly builds use + so they sort higher than the base release:
+#   v0.24.1-25-g9cf02a7d -> 0.24.1+25~g9cf02a7d
+# Tagged pre-release versions use ~ so they sort lower:
+#   v0.1.0-beta.1        -> 0.1.0~beta.1
+tilde='~'
+pkgVersion="${VERSION#v}"
+if [ -n "$NIGHTLY_BUILD" ]; then
+  pkgVersion="${pkgVersion/-/+}"
+fi
+pkgVersion="${pkgVersion//-/$tilde}"
+
+gen-deb-changelog "$VERSION" "$pkgVersion" "$DISTRO_RELEASE" "$DISTRO_ID" "$DISTRO_SUITE" "$PKG_DEB_REVISION" "$PKG_DEB_EPOCH"
+
+pkgoutput="${OUTDIR}/${DISTRO_RELEASE}/${DISTRO_SUITE}/$(xx-info arch)"
+if [ -n "$(xx-info variant)" ]; then
+  pkgoutput="${pkgoutput}/$(xx-info variant)"
+fi
+mkdir -p "${pkgoutput}"
+
+set -x
+
+chmod -x debian/control debian/copyright
+VERSION=${VERSION} COMMIT=${COMMIT} BUILD=${BUILD} DATE=${DATE} BUILD_ENV_FILE=${BUILD_ENV_FILE} \
+  dpkg-buildpackage $PKG_DEB_BUILDFLAGS --host-arch $(xx-info debian-arch) --target-arch $(xx-info debian-arch)
+cp /root/docker-* "${pkgoutput}"/
diff --git a/pkg/offload/scripts/pkg-rpm-build.sh b/pkg/offload/scripts/pkg-rpm-build.sh
new file mode 100755
index 00000000..83aa2611
--- /dev/null
+++ b/pkg/offload/scripts/pkg-rpm-build.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Docker Packaging authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+: "${NIGHTLY_BUILD=}"
+: "${VERSION=}"
+: "${COMMIT=}"
+: "${BUILD=}"
+: "${DATE=}"
+
+: "${DISTRO_NAME=}"
+: "${DISTRO_RELEASE=}"
+: "${DISTRO_ID=}"
+: "${DISTRO_SUITE=}"
+
+: "${PKG_NAME=}"
+: "${PKG_PACKAGER=}"
+: "${PKG_VENDOR=}"
+
+: "${PKG_RPM_RELEASE=}"
+
+: "${SOURCE_DATE_EPOCH=}"
+: "${SRCDIR=/usr/local/src/offload}"
+: "${OUTDIR=/out}"
+: "${BUILD_ENV_FILE=}"
+
+set -e
+
+if [ -z "$VERSION" ]; then
+  echo >&2 "error: VERSION is required"
+  exit 1
+fi
+case "$VERSION" in
+  v*) ;;
+  *) echo >&2 "error: VERSION must start with v, got $VERSION"; exit 1 ;;
+esac
+if [ -z "$DISTRO_NAME" ]; then
+  echo >&2 "error: DISTRO_NAME is required"
+  exit 1
+fi
+if [ -z "$OUTDIR" ]; then
+  echo >&2 "error: OUTDIR is required"
+  exit 1
+fi
+if [ ! -f "${SRCDIR}/Makefile" ]; then
+  echo >&2 "error: no Makefile in ${SRCDIR}; pass the source tree as the src named context"
+  exit 1
+fi
+
+mkdir -p "$OUTDIR"
+
+if ! command -v xx-info &> /dev/null; then
+  echo >&2 "error: xx cross compilation helper is required"
+  exit 1
+fi
+
+# Derive rpm-compatible package version from VERSION.
+# Nightly builds use + so they sort higher than the base release:
+#   v0.24.1-25-g9cf02a7d -> 0.24.1+25~g9cf02a7d
+# Tagged pre-release versions use ~ so they sort lower:
+#   v0.1.0-beta.1        -> 0.1.0~beta.1
+tilde='~'
+pkgVersion="${VERSION#v}"
+if [ -n "$NIGHTLY_BUILD" ]; then
+  pkgVersion="${pkgVersion/-/+}"
+fi
+pkgVersion="${pkgVersion//-/$tilde}"
+
+# rpm rejects macros with an empty body, so optional values default to %{nil}.
+nil='%{nil}'
+rpmDefine=(
+  --define "_version ${pkgVersion}"
+  --define "_origversion ${VERSION}"
+  --define "_release ${PKG_RPM_RELEASE:-1}"
+  --define "_srcdir ${SRCDIR}"
+  --define "_commit ${COMMIT:-$nil}"
+  --define "_build ${BUILD:-$nil}"
+  --define "_date ${DATE:-$nil}"
+  --define "_buildenvfile ${BUILD_ENV_FILE:-$nil}"
+)
+
+pkgoutput="${OUTDIR}/${DISTRO_RELEASE}/${DISTRO_SUITE}/$(xx-info arch)"
+if [ -n "$(xx-info variant)" ]; then
+  pkgoutput="${pkgoutput}/$(xx-info variant)"
+fi
+
+set -x
+
+rpmbuild --target $(xx-info rhel-arch) $PKG_RPM_BUILDFLAGS "${rpmDefine[@]}" /root/rpmbuild/SPECS/*.spec
+mkdir -p "${pkgoutput}"
+cp ./RPMS/*/*.* "${pkgoutput}"/
+if [ "$(ls -A ./SRPMS)" ]; then
+  cp ./SRPMS/* "${pkgoutput}"/
+fi
diff --git a/pkg/offload/verify.Dockerfile b/pkg/offload/verify.Dockerfile
new file mode 100644
index 00000000..ac2dda47
--- /dev/null
+++ b/pkg/offload/verify.Dockerfile
@@ -0,0 +1,107 @@
+# syntax=docker/dockerfile:1
+
+# Copyright 2026 Docker Packaging authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Installs the built package on a clean distro image and checks the plugin it installs.
+
+ARG XX_VERSION="1.10.0"
+
+ARG DISTRO_TYPE="deb"
+ARG DISTRO_IMAGE="debian:trixie"
+
+# cross compilation helper
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
+
+FROM scratch AS bin
+FROM scratch AS scripts
+
+FROM ${DISTRO_IMAGE} AS base
+# The version the plugin must report, for example v0.7.48. Empty skips the version check.
+ARG VERSION=""
+ARG PLUGIN=/usr/libexec/docker/cli-plugins/docker-offload
+
+FROM base AS verify-deb
+COPY --from=xx / /
+ARG DISTRO_RELEASE
+ARG DISTRO_ID
+ARG DISTRO_SUITE
+ARG TARGETPLATFORM
+ARG VERSION
+ARG PLUGIN
+RUN --mount=from=bin,target=/build <<EOT
+  set -e
+  targetplatform=$(xx-info os)_$(xx-info arch)
+  if [ -n "$(xx-info variant)" ]; then
+    targetplatform="${targetplatform}_$(xx-info variant)"
+  fi
+  dir=/build/${targetplatform}/${DISTRO_RELEASE}/${DISTRO_SUITE}/$(xx-info arch)
+  if [ ! -d "$dir" ]; then
+    echo >&2 "error: no packages found in $dir"
+    exit 1
+  fi
+  for package in $(find $dir -type f -name '*.deb'); do
+    (
+      set -x
+      dpkg-deb --info $package
+      apt-get update
+      apt-get install -y --no-install-recommends $package
+    )
+  done
+  set -x
+  test -x "$PLUGIN"
+  "$PLUGIN" docker-cli-plugin-metadata
+  if [ -n "$VERSION" ]; then
+    "$PLUGIN" docker-cli-plugin-metadata | grep -F "\"Version\": \"$VERSION\""
+  fi
+EOT
+
+FROM base AS verify-rpm
+COPY --from=xx / /
+ARG DISTRO_NAME
+ARG DISTRO_RELEASE
+ARG DISTRO_ID
+ARG DISTRO_SUITE
+RUN --mount=type=bind,from=scripts,source=verify-rpm-init.sh,target=/usr/local/bin/verify-rpm-init \
+  verify-rpm-init $DISTRO_NAME
+ARG TARGETPLATFORM
+ARG VERSION
+ARG PLUGIN
+RUN --mount=from=bin,target=/build <<EOT
+  set -e
+  targetplatform=$(xx-info os)_$(xx-info arch)
+  if [ -n "$(xx-info variant)" ]; then
+    targetplatform="${targetplatform}_$(xx-info variant)"
+  fi
+  dir=/build/${targetplatform}/${DISTRO_RELEASE}/${DISTRO_SUITE}/$(xx-info arch)
+  if [ ! -d "$dir" ]; then
+    echo >&2 "error: no packages found in $dir"
+    exit 1
+  fi
+  for package in $(find $dir -type f -name '*.rpm' ! -name '*.src.rpm'); do
+    (
+      set -x
+      rpm -qilp $package
+      dnf install -y $package
+    )
+  done
+  set -x
+  test -x "$PLUGIN"
+  "$PLUGIN" docker-cli-plugin-metadata
+  if [ -n "$VERSION" ]; then
+    "$PLUGIN" docker-cli-plugin-metadata | grep -F "\"Version\": \"$VERSION\""
+  fi
+EOT
+
+FROM verify-${DISTRO_TYPE} AS verify