diff --git a/.github/workflows/alpine.yml b/.github/workflows/alpine.yml
new file mode 100644
index 0000000..fcad9b0
--- /dev/null
+++ b/.github/workflows/alpine.yml
@@ -0,0 +1,43 @@
+name: Validate Alpine
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '**/alpine*/Dockerfile'
+      - '.github/workflows/alpine.yml'
+
+jobs:
+  build-smoke-test:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    name: ${{ matrix.ghc }}-alpine${{ matrix.os_version }}
+    strategy:
+      fail-fast: false
+      matrix:
+        ghc: ['9.0.2', '9.2.2']
+        os_version: ['3.14', '3.15']
+        include:
+          - ghc: '9.0.2'
+            ghc_minor: '9.0'
+          - ghc: '9.2.2'
+            ghc_minor: '9.2'
+    steps:
+      - uses: actions/checkout@v2
+      - name: build + smoke test [${{ matrix.ghc }}]
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 8
+          max_attempts: 3
+          command: |
+            docker build --pull \
+              -t haskell:${{ matrix.ghc }}-alpine${{ matrix.os_version }} \
+              ${{ matrix.ghc_minor }}/alpine${{ matrix.os_version }}
+      - uses: actions/checkout@v2
+        with:
+          repository: AlistairB/official-images
+          ref: haskell-sh
+          path: official-images
+      - name: run official-images tests
+        run: ./official-images/test/run.sh haskell:${{ matrix.ghc }}-alpine${{ matrix.os_version }}
diff --git a/9.0/alpine3.14/Dockerfile b/9.0/alpine3.14/Dockerfile
new file mode 100644
index 0000000..aa55a29
--- /dev/null
+++ b/9.0/alpine3.14/Dockerfile
@@ -0,0 +1,124 @@
+FROM alpine:3.14
+
+RUN apk add --no-cache \
+    ca-certificates \
+    curl \
+    gcc \
+    git \
+    g++ \
+    gmp-dev \
+    musl-dev \
+    ncurses-dev \
+    libc-dev \
+    libffi-dev
+
+ARG CABAL_INSTALL=3.6.2.0
+ARG CABAL_INSTALL_RELEASE_KEY=A970DF3AC3B9709706D74544B3D9F94B8DCAE210
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-alpine.tar.xz"; \
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+    # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            CABAL_INSTALL_SHA256='2d3d5e4aa83aad06ed723d7038eac41271d62b56251e0a76fa35db5f902250e3'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -sSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
+    echo "$CABAL_INSTALL_SHA256  cabal-install.tar.gz" | sha256sum -c; \
+    \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    # confirm we are verying SHA256SUMS that matches the release + sha256
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
+    gpgconf --kill all; \
+    \
+    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    cabal --version
+
+ARG GHC=9.0.2
+ARG GHC_RELEASE_KEY=88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg make; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-alpine3.12-linux-gmp.tar.xz"; \
+    # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            GHC_SHA256='5bb1e7192c2b9fcff68930dbdc65509d345138e9a43c5d447056a68decc05ec8'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
+    echo "$GHC_SHA256  ghc.tar.xz" | sha256sum -c; \
+    \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
+    gpgconf --kill all; \
+    \
+    tar xf ghc.tar.xz; \
+    cd "ghc-$GHC-$ARCH-unknown-linux"; \
+    ./configure --prefix "/opt/ghc/$GHC" --disable-ld-override; \
+    make install; \
+    # remove profiling support to save space
+    find "/opt/ghc/$GHC/" \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete; \
+    # remove some docs
+    rm -rf "/opt/ghc/$GHC/share/"; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    "/opt/ghc/$GHC/bin/ghc" --version
+
+ARG STACK=2.7.5
+ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
+    case "$ARCH" in \
+        'x86_64') \
+            STACK_SHA256='9bcd165358d4dcafd2b33320d4fe98ce72faaf62300cc9b0fb86a27eb670da50'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$STACK_URL" -o stack.tar.gz; \
+    echo "$STACK_SHA256  stack.tar.gz" | sha256sum -c; \
+    \
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
+    gpgconf --kill all; \
+    \
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
+    stack config set system-ghc --global true; \
+    stack config set install-ghc --global false; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    stack --version;
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
+
+CMD ["ghci"]
diff --git a/9.0/alpine3.15/Dockerfile b/9.0/alpine3.15/Dockerfile
new file mode 100644
index 0000000..17b48d2
--- /dev/null
+++ b/9.0/alpine3.15/Dockerfile
@@ -0,0 +1,124 @@
+FROM alpine:3.15
+
+RUN apk add --no-cache \
+    ca-certificates \
+    curl \
+    gcc \
+    git \
+    g++ \
+    gmp-dev \
+    musl-dev \
+    ncurses-dev \
+    libc-dev \
+    libffi-dev
+
+ARG CABAL_INSTALL=3.6.2.0
+ARG CABAL_INSTALL_RELEASE_KEY=A970DF3AC3B9709706D74544B3D9F94B8DCAE210
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-alpine.tar.xz"; \
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+    # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            CABAL_INSTALL_SHA256='2d3d5e4aa83aad06ed723d7038eac41271d62b56251e0a76fa35db5f902250e3'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -sSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
+    echo "$CABAL_INSTALL_SHA256  cabal-install.tar.gz" | sha256sum -c; \
+    \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    # confirm we are verying SHA256SUMS that matches the release + sha256
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
+    gpgconf --kill all; \
+    \
+    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    cabal --version
+
+ARG GHC=9.0.2
+ARG GHC_RELEASE_KEY=88B57FCF7DB53B4DB3BFA4B1588764FBE22D19C4
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg make; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-alpine3.12-linux-gmp.tar.xz"; \
+    # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            GHC_SHA256='5bb1e7192c2b9fcff68930dbdc65509d345138e9a43c5d447056a68decc05ec8'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
+    echo "$GHC_SHA256  ghc.tar.xz" | sha256sum -c; \
+    \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
+    gpgconf --kill all; \
+    \
+    tar xf ghc.tar.xz; \
+    cd "ghc-$GHC-$ARCH-unknown-linux"; \
+    ./configure --prefix "/opt/ghc/$GHC" --disable-ld-override; \
+    make install; \
+    # remove profiling support to save space
+    find "/opt/ghc/$GHC/" \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete; \
+    # remove some docs
+    rm -rf "/opt/ghc/$GHC/share/"; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    "/opt/ghc/$GHC/bin/ghc" --version
+
+ARG STACK=2.7.5
+ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
+    case "$ARCH" in \
+        'x86_64') \
+            STACK_SHA256='9bcd165358d4dcafd2b33320d4fe98ce72faaf62300cc9b0fb86a27eb670da50'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$STACK_URL" -o stack.tar.gz; \
+    echo "$STACK_SHA256  stack.tar.gz" | sha256sum -c; \
+    \
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
+    gpgconf --kill all; \
+    \
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
+    stack config set system-ghc --global true; \
+    stack config set install-ghc --global false; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    stack --version;
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
+
+CMD ["ghci"]
diff --git a/9.2/alpine3.14/Dockerfile b/9.2/alpine3.14/Dockerfile
new file mode 100644
index 0000000..57f3a04
--- /dev/null
+++ b/9.2/alpine3.14/Dockerfile
@@ -0,0 +1,124 @@
+FROM alpine:3.14
+
+RUN apk add --no-cache \
+    ca-certificates \
+    curl \
+    gcc \
+    git \
+    g++ \
+    gmp-dev \
+    musl-dev \
+    ncurses-dev \
+    libc-dev \
+    libffi-dev
+
+ARG CABAL_INSTALL=3.6.2.0
+ARG CABAL_INSTALL_RELEASE_KEY=A970DF3AC3B9709706D74544B3D9F94B8DCAE210
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-alpine.tar.xz"; \
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+    # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            CABAL_INSTALL_SHA256='2d3d5e4aa83aad06ed723d7038eac41271d62b56251e0a76fa35db5f902250e3'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -sSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
+    echo "$CABAL_INSTALL_SHA256  cabal-install.tar.gz" | sha256sum -c; \
+    \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    # confirm we are verying SHA256SUMS that matches the release + sha256
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
+    gpgconf --kill all; \
+    \
+    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    cabal --version
+
+ARG GHC=9.2.2
+ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg make; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-alpine3.12-linux-gmp.tar.xz"; \
+    # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            GHC_SHA256='624523826e24eae33c03490267cddecc1d80c047f2a3f4b03580f1040112d5c0'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
+    echo "$GHC_SHA256  ghc.tar.xz" | sha256sum -c; \
+    \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
+    gpgconf --kill all; \
+    \
+    tar xf ghc.tar.xz; \
+    cd "ghc-$GHC-$ARCH-unknown-linux"; \
+    ./configure --prefix "/opt/ghc/$GHC" --disable-ld-override; \
+    make install; \
+    # remove profiling support to save space
+    find "/opt/ghc/$GHC/" \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete; \
+    # remove some docs
+    rm -rf "/opt/ghc/$GHC/share/"; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    "/opt/ghc/$GHC/bin/ghc" --version
+
+ARG STACK=2.7.5
+ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
+    case "$ARCH" in \
+        'x86_64') \
+            STACK_SHA256='9bcd165358d4dcafd2b33320d4fe98ce72faaf62300cc9b0fb86a27eb670da50'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$STACK_URL" -o stack.tar.gz; \
+    echo "$STACK_SHA256  stack.tar.gz" | sha256sum -c; \
+    \
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
+    gpgconf --kill all; \
+    \
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
+    stack config set system-ghc --global true; \
+    stack config set install-ghc --global false; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    stack --version;
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
+
+CMD ["ghci"]
diff --git a/9.2/alpine3.15/Dockerfile b/9.2/alpine3.15/Dockerfile
new file mode 100644
index 0000000..c16e587
--- /dev/null
+++ b/9.2/alpine3.15/Dockerfile
@@ -0,0 +1,124 @@
+FROM alpine:3.15
+
+RUN apk add --no-cache \
+    ca-certificates \
+    curl \
+    gcc \
+    git \
+    g++ \
+    gmp-dev \
+    musl-dev \
+    ncurses-dev \
+    libc-dev \
+    libffi-dev
+
+ARG CABAL_INSTALL=3.6.2.0
+ARG CABAL_INSTALL_RELEASE_KEY=A970DF3AC3B9709706D74544B3D9F94B8DCAE210
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    CABAL_INSTALL_TAR="cabal-install-$CABAL_INSTALL-$ARCH-linux-alpine.tar.xz"; \
+    CABAL_INSTALL_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/$CABAL_INSTALL_TAR"; \
+    CABAL_INSTALL_SHA256SUMS_URL="https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS"; \
+    # sha256 from https://downloads.haskell.org/~cabal/cabal-install-$CABAL_INSTALL/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            CABAL_INSTALL_SHA256='2d3d5e4aa83aad06ed723d7038eac41271d62b56251e0a76fa35db5f902250e3'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'"; exit 1 ;; \
+    esac; \
+    curl -sSL "$CABAL_INSTALL_URL" -o cabal-install.tar.gz; \
+    echo "$CABAL_INSTALL_SHA256  cabal-install.tar.gz" | sha256sum -c; \
+    \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL"; \
+    curl -sSLO "$CABAL_INSTALL_SHA256SUMS_URL.sig"; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$CABAL_INSTALL_RELEASE_KEY"; \
+    gpg --batch --verify SHA256SUMS.sig SHA256SUMS; \
+    # confirm we are verying SHA256SUMS that matches the release + sha256
+    grep "$CABAL_INSTALL_SHA256  $CABAL_INSTALL_TAR" SHA256SUMS; \
+    gpgconf --kill all; \
+    \
+    tar -xf cabal-install.tar.gz -C /usr/local/bin; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    cabal --version
+
+ARG GHC=9.2.2
+ARG GHC_RELEASE_KEY=FFEB7CE81E16A36B3E2DED6F2DE04D4E97DB64AD
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg make; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    GHC_URL="https://downloads.haskell.org/~ghc/$GHC/ghc-$GHC-$ARCH-alpine3.12-linux-gmp.tar.xz"; \
+    # sha256 from https://downloads.haskell.org/~ghc/$GHC/SHA256SUMS
+    case "$ARCH" in \
+        'x86_64') \
+            GHC_SHA256='624523826e24eae33c03490267cddecc1d80c047f2a3f4b03580f1040112d5c0'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$GHC_URL" -o ghc.tar.xz; \
+    echo "$GHC_SHA256  ghc.tar.xz" | sha256sum -c; \
+    \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    curl -sSL "$GHC_URL.sig" -o ghc.tar.xz.sig; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$GHC_RELEASE_KEY"; \
+    gpg --batch --verify ghc.tar.xz.sig ghc.tar.xz; \
+    gpgconf --kill all; \
+    \
+    tar xf ghc.tar.xz; \
+    cd "ghc-$GHC-$ARCH-unknown-linux"; \
+    ./configure --prefix "/opt/ghc/$GHC" --disable-ld-override; \
+    make install; \
+    # remove profiling support to save space
+    find "/opt/ghc/$GHC/" \( -name "*_p.a" -o -name "*.p_hi" \) -type f -delete; \
+    # remove some docs
+    rm -rf "/opt/ghc/$GHC/share/"; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    "/opt/ghc/$GHC/bin/ghc" --version
+
+ARG STACK=2.7.5
+ARG STACK_RELEASE_KEY=C5705533DA4F78D8664B5DC0575159689BEFB442
+
+RUN set -eux; \
+    apk add --no-cache --virtual .fetch-deps gnupg; \
+    cd /tmp; \
+    ARCH="$(apk --print-arch)"; \
+    STACK_URL="https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz"; \
+    # sha256 from https://github.com/commercialhaskell/stack/releases/download/v${STACK}/stack-${STACK}-linux-$ARCH.tar.gz.sha256
+    case "$ARCH" in \
+        'x86_64') \
+            STACK_SHA256='9bcd165358d4dcafd2b33320d4fe98ce72faaf62300cc9b0fb86a27eb670da50'; \
+            ;; \
+        *) echo >&2 "error: unsupported architecture '$ARCH'" ; exit 1 ;; \
+    esac; \
+    curl -sSL "$STACK_URL" -o stack.tar.gz; \
+    echo "$STACK_SHA256  stack.tar.gz" | sha256sum -c; \
+    \
+    curl -sSL "$STACK_URL.asc" -o stack.tar.gz.asc; \
+    GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
+    gpg --batch --keyserver keyserver.ubuntu.com --receive-keys "$STACK_RELEASE_KEY"; \
+    gpg --batch --verify stack.tar.gz.asc stack.tar.gz; \
+    gpgconf --kill all; \
+    \
+    tar -xf stack.tar.gz -C /usr/local/bin --strip-components=1 "stack-$STACK-linux-$ARCH/stack"; \
+    stack config set system-ghc --global true; \
+    stack config set install-ghc --global false; \
+    \
+    rm -rf /tmp/*; \
+    apk del --no-network .fetch-deps; \
+    \
+    stack --version;
+
+ENV PATH /root/.cabal/bin:/root/.local/bin:/opt/ghc/${GHC}/bin:$PATH
+
+CMD ["ghci"]