diff --git a/debian/changelog b/debian/changelog
index cb33769c..53878aaf 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,18 @@
+livecd-rootfs (2.408.44) xenial; urgency=medium
+
+  * Make sure buildd images have a /usr/sbin/policy-rc.d symlink
+    (LP: #1815251).
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Mon, 18 Feb 2019 16:05:32 +0000
+
+livecd-rootfs (2.408.43) xenial; urgency=medium
+
+  * Add a buildd subproject (LP: #1815251).
+  * Add a LXD image to builds for the buildd subproject.
+  * Move buildd image building to binary hooks.
+
+ -- Colin Watson <cjwatson@ubuntu.com>  Fri, 08 Feb 2019 22:56:03 +0000
+
 livecd-rootfs (2.408.42) xenial; urgency=medium
 
   [ Cody Shepherd ]
diff --git a/debian/control b/debian/control
index 00739806..50244066 100644
--- a/debian/control
+++ b/debian/control
@@ -4,7 +4,7 @@ Priority: optional
 Build-Depends: debhelper (>= 7)
 Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
 Standards-Version: 3.9.6
-Vcs-Bzr: lp:~ubuntu-core-dev/livecd-rootfs/xenial-proposed/
+Vcs-Git: https://git.launchpad.net/livecd-rootfs -b ubuntu/xenial
 
 Package: livecd-rootfs
 Architecture: any
diff --git a/debian/tests/default-bootstraps b/debian/tests/default-bootstraps
index 433cd327..a96d0b67 100755
--- a/debian/tests/default-bootstraps
+++ b/debian/tests/default-bootstraps
@@ -25,6 +25,7 @@ ALL_TRIPLETS="
  mythbuntu::
  ubuntu::
  ubuntu-base::
+ ubuntu-base:buildd:
  ubuntu-budgie::
  ubuntu-budgie-desktop::
  ubuntu-budgie-live::
diff --git a/live-build/auto/build b/live-build/auto/build
index 1ecfb51e..35491ca3 100755
--- a/live-build/auto/build
+++ b/live-build/auto/build
@@ -17,7 +17,7 @@ fi
 
 . config/functions
 
-# Link output files somewhere BuildLiveCD will be able to find them.
+# Link output files somewhere launchpad-buildd will be able to find them.
 PREFIX="livecd.$PROJECT${SUBARCH:+-$SUBARCH}"
 
 if [ "${IMAGEFORMAT:-}" = "ubuntu-image" ]; then
diff --git a/live-build/auto/config b/live-build/auto/config
index c64cf7a5..17c9de97 100755
--- a/live-build/auto/config
+++ b/live-build/auto/config
@@ -611,6 +611,37 @@ case $PROJECT in
 		;;
 esac
 
+case $SUBPROJECT in
+	buildd)
+		OPTS="${OPTS:+$OPTS }--archive-areas main"
+		COMPONENTS='main restricted universe multiverse'
+		OPTS="${OPTS:+$OPTS }--apt-recommends false"
+		OPTS="${OPTS:+$OPTS }--apt-secure false"
+		OPTS="${OPTS:+$OPTS }--parent-mirror-binary ${MIRROR}"
+		# XXX cjwatson 2018-04-27: We need to work out how to make
+		# this conditional so that we can do things like building
+		# buildd chroots with -updates.  This probably involves
+		# either extending the PROPOSED hack or fixing the strange
+		# way that SUITE is in fact a series; in either case it's
+		# likely to involve work both here and in launchpad-buildd.
+		OPTS="${OPTS:+$OPTS }--security false --volatile false"
+
+		add_package install adduser
+		add_package install policyrcd-script-zg2
+		add_package install pkgbinarymangler
+		add_package install ca-certificates
+		add_package install pkg-create-dbgsym
+		add_package install apt-transport-https
+		add_package install tzdata
+		add_package install fakeroot
+		add_package install build-essential
+		# Needed for LXD-based builds.
+		add_package install init
+
+		cp -af /usr/share/livecd-rootfs/live-build/make-lxd-metadata.py config/make-lxd-metadata
+		;;
+esac
+
 if [ "$PREINSTALLED" != "true" ] && [ "$LIVE_TASK" ]; then
 	add_task live "$LIVE_TASK"
 fi
@@ -883,6 +914,12 @@ EOF
 		;;
 esac
 
+case $SUBPROJECT in
+	buildd)
+		cp -af /usr/share/livecd-rootfs/live-build/buildd/* config/
+		;;
+esac
+
 if [ "$EXTRA_PPAS" ]; then
 	rm -f config/archives/extra-ppas.list.chroot \
 	      config/archives/extra-ppas.pref.chroot \
diff --git a/live-build/buildd/hooks/00-kernel-img.chroot b/live-build/buildd/hooks/00-kernel-img.chroot
new file mode 100755
index 00000000..3517b443
--- /dev/null
+++ b/live-build/buildd/hooks/00-kernel-img.chroot
@@ -0,0 +1,5 @@
+#! /bin/sh
+set -e
+
+# At one point, kernel builds needed this.
+echo do_initrd = Yes >>/etc/kernel-img.conf
diff --git a/live-build/buildd/hooks/00-mirror.binary b/live-build/buildd/hooks/00-mirror.binary
new file mode 100755
index 00000000..7f3cdba4
--- /dev/null
+++ b/live-build/buildd/hooks/00-mirror.binary
@@ -0,0 +1,12 @@
+#! /bin/sh
+set -e
+
+. config/bootstrap
+
+# Use a public-facing mirror URL, for the benefit of
+# sbuild-launchpad-chroot.  We deliberately do this only after live-build
+# has run "apt-get update" for the last time, in order that
+# /var/lib/apt/lists/ has suitable cached Packages files; this speeds up
+# builds on buildds.
+sed -i "s,${LB_PARENT_MIRROR_BINARY},${LB_MIRROR_BINARY},g" \
+	binary/etc/apt/sources.list
diff --git a/live-build/buildd/hooks/01-pkgbinarymangler.chroot b/live-build/buildd/hooks/01-pkgbinarymangler.chroot
new file mode 100755
index 00000000..ab901957
--- /dev/null
+++ b/live-build/buildd/hooks/01-pkgbinarymangler.chroot
@@ -0,0 +1,10 @@
+#! /bin/sh
+set -e
+
+# Configure pkgbinarymangler.
+sed -i /^enable/s/false/true/ \
+	/etc/pkgbinarymangler/maintainermangler.conf \
+	/etc/pkgbinarymangler/striptranslations.conf || true
+sed -i /^invalid_current/s/ignore/fail/ \
+	/etc/pkgbinarymangler/maintainermangler.conf \
+	/etc/pkgbinarymangler/striptranslations.conf || true
diff --git a/live-build/buildd/hooks/01-policy-rc-d.binary b/live-build/buildd/hooks/01-policy-rc-d.binary
new file mode 100755
index 00000000..d827875f
--- /dev/null
+++ b/live-build/buildd/hooks/01-policy-rc-d.binary
@@ -0,0 +1,13 @@
+#! /bin/sh
+set -e
+
+# Put the /usr/sbin/policy-rc.d alternatives symlink in place.  Ordinarily
+# update-alternatives ought to create this when policyrcd-script-zg2 is
+# installed, but that doesn't work because live-build has already installed
+# a dummy one at that point.  The simplest approach is to repair the
+# situation by putting it in place here.
+if [ -L binary/etc/alternatives/policy-rc.d ] && \
+   [ ! -e binary/usr/sbin/policy-rc.d ] && \
+   [ ! -L binary/usr/sbin/policy-rc.d ]; then
+	ln -s /etc/alternatives/policy-rc.d binary/usr/sbin/policy-rc.d
+fi
diff --git a/live-build/buildd/hooks/02-user.chroot b/live-build/buildd/hooks/02-user.chroot
new file mode 100755
index 00000000..86000bf2
--- /dev/null
+++ b/live-build/buildd/hooks/02-user.chroot
@@ -0,0 +1,9 @@
+#! /bin/sh
+set -e
+
+# Create the buildd user and group.
+addgroup --gid 2501 buildd
+adduser --system --disabled-password --gecos 'Build Daemon user' \
+	--ingroup buildd --uid 2001 --shell /bin/bash buildd
+mkdir -p /build/buildd
+chown buildd:buildd /build/buildd
diff --git a/live-build/buildd/hooks/50-buildd-tar.binary b/live-build/buildd/hooks/50-buildd-tar.binary
new file mode 100755
index 00000000..8be7b618
--- /dev/null
+++ b/live-build/buildd/hooks/50-buildd-tar.binary
@@ -0,0 +1,10 @@
+#! /bin/sh
+# A few things (launchpad-buildd, sbuild-launchpad-chroot) rely on the
+# top-level directory being "chroot-autobuild", so we have to do this
+# ourselves.
+set -e
+
+# gzip was chosen for fastest decompression speed: it decompresses buildd
+# chroots about twice as fast as xz and about five times as fast as bzip2.
+tar --transform='s,^binary,chroot-autobuild,' --sort=name --numeric-owner \
+	-czf "livecd.$PROJECT.rootfs.tar.gz" binary
diff --git a/live-build/buildd/hooks/51-buildd-lxd.binary b/live-build/buildd/hooks/51-buildd-lxd.binary
new file mode 100755
index 00000000..b4b782d9
--- /dev/null
+++ b/live-build/buildd/hooks/51-buildd-lxd.binary
@@ -0,0 +1,16 @@
+#! /bin/sh
+# Some build types prefer a LXD image over a traditional chroot tarball.
+set -e
+
+. config/bootstrap
+
+TMPDIR="$(mktemp -d)"
+config/make-lxd-metadata "${LB_DISTRIBUTION%-*}" "$ARCH" \
+	>"$TMPDIR/metadata.yaml"
+tar --numeric-owner -cf "livecd.$PROJECT.lxd.tar" -C "$TMPDIR" metadata.yaml
+rm -rf "$TMPDIR"
+# When using the combined metadata/rootfs form, the rootfs must be under
+# rootfs/ rather than under chroot-autobuild/.
+tar --transform='s,^binary,rootfs,' --sort=name --numeric-owner \
+	-rf "livecd.$PROJECT.lxd.tar" binary
+gzip -9 "livecd.$PROJECT.lxd.tar"
diff --git a/live-build/buildd/includes.chroot/etc/apt/apt.conf.d/99buildd b/live-build/buildd/includes.chroot/etc/apt/apt.conf.d/99buildd
new file mode 100644
index 00000000..0fd77978
--- /dev/null
+++ b/live-build/buildd/includes.chroot/etc/apt/apt.conf.d/99buildd
@@ -0,0 +1,2 @@
+DPkg::Options {"--force-unsafe-io";};
+DPkg::Use-Pty "false";
diff --git a/live-build/buildd/includes.chroot/etc/apt/preferences.d/backports b/live-build/buildd/includes.chroot/etc/apt/preferences.d/backports
new file mode 100644
index 00000000..605907ec
--- /dev/null
+++ b/live-build/buildd/includes.chroot/etc/apt/preferences.d/backports
@@ -0,0 +1,3 @@
+Package: *
+Pin: release a=*-backports
+Pin-Priority: 500
diff --git a/live-build/buildd/includes.chroot/etc/fstab b/live-build/buildd/includes.chroot/etc/fstab
new file mode 100644
index 00000000..b67dd265
--- /dev/null
+++ b/live-build/buildd/includes.chroot/etc/fstab
@@ -0,0 +1 @@
+/dev/root / ext2 noatime,errors=remount-ro 0 1
diff --git a/live-build/buildd/includes.chroot/etc/hostname b/live-build/buildd/includes.chroot/etc/hostname
new file mode 100644
index 00000000..e420fe4d
--- /dev/null
+++ b/live-build/buildd/includes.chroot/etc/hostname
@@ -0,0 +1 @@
+INVALID
diff --git a/live-build/buildd/includes.chroot/etc/hosts b/live-build/buildd/includes.chroot/etc/hosts
new file mode 100644
index 00000000..7a0cb5d4
--- /dev/null
+++ b/live-build/buildd/includes.chroot/etc/hosts
@@ -0,0 +1,9 @@
+127.0.0.1	localhost.localdomain	localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
diff --git a/live-build/buildd/includes.chroot/etc/resolv.conf b/live-build/buildd/includes.chroot/etc/resolv.conf
new file mode 100644
index 00000000..e69de29b
diff --git a/live-build/buildd/includes.chroot/usr/local/sbin/policy-rc.d b/live-build/buildd/includes.chroot/usr/local/sbin/policy-rc.d
new file mode 100755
index 00000000..cf2290b6
--- /dev/null
+++ b/live-build/buildd/includes.chroot/usr/local/sbin/policy-rc.d
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# policy-rc.d script for chroots.
+# Copyright (c) 2007 Peter Palfrader <peter@palfrader.org>
+# License: <weasel> MIT, if you want one.
+
+while true; do
+  case "$1" in
+    -*)         shift ;;
+    makedev)    exit 0;;
+    *) echo "Not running services in chroot."; exit 101 ;;
+  esac
+done
diff --git a/live-build/buildd/preseed/debconf.preseed b/live-build/buildd/preseed/debconf.preseed
new file mode 100644
index 00000000..4e8c607b
--- /dev/null
+++ b/live-build/buildd/preseed/debconf.preseed
@@ -0,0 +1,2 @@
+# We never want debconf interaction.
+debconf debconf/frontend select Noninteractive
diff --git a/live-build/buildd/preseed/man-db.preseed b/live-build/buildd/preseed/man-db.preseed
new file mode 100644
index 00000000..7281ae4d
--- /dev/null
+++ b/live-build/buildd/preseed/man-db.preseed
@@ -0,0 +1,3 @@
+# Avoid unnecessary manual page database builds (see
+# https://bugs.debian.org/554914).
+man-db man-db/auto-update boolean false
diff --git a/live-build/buildd/preseed/sun-java6.preseed b/live-build/buildd/preseed/sun-java6.preseed
new file mode 100644
index 00000000..53011956
--- /dev/null
+++ b/live-build/buildd/preseed/sun-java6.preseed
@@ -0,0 +1,3 @@
+# Pre-accept interactive EULA prompts.
+sun-java6-bin shared/accepted-sun-dlj-v1-1 boolean true
+sun-java6-jre shared/accepted-sun-dlj-v1-1 boolean true
diff --git a/live-build/make-lxd-metadata.py b/live-build/make-lxd-metadata.py
new file mode 100755
index 00000000..896f811a
--- /dev/null
+++ b/live-build/make-lxd-metadata.py
@@ -0,0 +1,49 @@
+#! /usr/bin/python3
+
+"""Make a metadata.yaml file for a LXD image."""
+
+import argparse
+import json
+import sys
+import time
+
+
+# Map dpkg architecture names to LXD architecture names.
+lxd_arches = {
+    "amd64": "x86_64",
+    "arm64": "aarch64",
+    "armhf": "armv7l",
+    "i386": "i686",
+    "powerpc": "ppc",
+    "ppc64el": "ppc64le",
+    "s390x": "s390x",
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("series", help="Ubuntu series name")
+    parser.add_argument("architecture", help="Ubuntu architecture name")
+    args = parser.parse_args()
+
+    metadata = {
+        "architecture": lxd_arches[args.architecture],
+        "creation_date": int(time.time()),
+        "properties": {
+            "os": "Ubuntu",
+            "series": args.series,
+            "architecture": args.architecture,
+            "description": "Ubuntu buildd %s %s" % (
+                args.series, args.architecture),
+            },
+        }
+
+    # Encoding this as JSON is good enough, and saves pulling in a YAML
+    # library dependency.
+    json.dump(
+        metadata, sys.stdout, sort_keys=True, indent=4, separators=(",", ": "),
+        ensure_ascii=False)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/live-build/ubuntu-cpc/includes.chroot/etc/network/interfaces.d/.keep b/live-build/ubuntu-cpc/includes.chroot/etc/network/interfaces.d/.keep
new file mode 100644
index 00000000..e69de29b