Preferred method for hermeticizing linux builds

On Windows and MacOS, I can simply package up the toolchain alongside all corresponding headers and libraries. Then clone them and configure my buck2 toolchain to use them by specifying include and library paths accordingly.

On Linux this isn't straightforward due to the variety of distributions and the fact that people can very easily modify their system by just updating a package. Everyone is going to have a different system, even if they're on the same exact distro version.

I can package up a sysroot (although I haven't been completely successful with this yet) and then pass `-isysroot` to the compiler, but I suspect even that can run into weird issues with glibc incompatibilities and the like.

I could also just throw my hands up in the air and use a docker container for the hermeticizing the build. This certainly works, but it makes debugging inconvenient and diverges from how we hermeticize builds on other platforms.

Based on the experience using buck2 inside of Meta, what have you found works the best?