diff --git a/docker/sysbox/sudo_test/Dockerfile b/docker/sysbox/sudo_test/Dockerfile
new file mode 100644
index 00000000..92f2e194
--- /dev/null
+++ b/docker/sysbox/sudo_test/Dockerfile
@@ -0,0 +1,41 @@
+FROM ubuntu:22.04
+
+RUN apt-get update -yq
+RUN apt-get install -yq ca-certificates curl gnupg
+RUN install -m 0755 -d /etc/apt/keyrings
+RUN curl --insecure -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+RUN chmod a+r /etc/apt/keyrings/docker.gpg
+RUN echo \
+  "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
+  "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
+  tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+ENV ENGFLOW_RBE_USER_ID=108
+ENV ENGFLOW_RBE_USER_NAME=engflow
+ENV ENGFLOW_RBE_GROUP_ID=114
+ENV ENGFLOW_RBE_GROUP_NAME=engflow
+
+RUN groupadd --non-unique -g "${ENGFLOW_RBE_GROUP_ID}" docker
+RUN groupadd --non-unique -g "${ENGFLOW_RBE_GROUP_ID}" "${ENGFLOW_RBE_GROUP_NAME}"
+
+RUN useradd \
+    -rm \
+    -s /bin/bash \
+    -g docker \
+    -u "${ENGFLOW_RBE_USER_ID}" \
+    "${ENGFLOW_RBE_USER_NAME}"
+
+RUN apt-get update -yq
+
+RUN apt-get install -yq sudo
+RUN echo "${ENGFLOW_RBE_USER_NAME} ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/${ENGFLOW_RBE_USER_NAME}"
+RUN chmod 0440 "/etc/sudoers.d/${ENGFLOW_RBE_USER_NAME}"
+
+RUN apt-get install -yq docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+
+COPY --chmod=0755 entrypoint.sh /entrypoint.sh
+
+USER root
+WORKDIR "/home/${ENGFLOW_RBE_USER_NAME}"
+
+ENTRYPOINT [ "/entrypoint.sh" ]
diff --git a/docker/sysbox/sudo_test/entrypoint.sh b/docker/sysbox/sudo_test/entrypoint.sh
new file mode 100644
index 00000000..6884e310
--- /dev/null
+++ b/docker/sysbox/sudo_test/entrypoint.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+check_docker_is_alive () {
+  while (! docker stats --no-stream &>>/dev/null ); do
+    # Docker takes a few seconds to initialize.
+    sleep 1
+  done
+}
+export -f check_docker_is_alive
+
+sudo dockerd -H tcp://0.0.0.0:2375 -H unix:///var/run/docker.sock &>>/dev/null &
+ # Time out after 1m to avoid waiting on docker forever.
+timeout 60s bash -c check_docker_is_alive
+eval "$@"
diff --git a/genrules/BUILD b/genrules/BUILD
index 1a462fa4..4151f4c7 100644
--- a/genrules/BUILD
+++ b/genrules/BUILD
@@ -45,6 +45,39 @@ UPPER_BOUND = 10
     tools = ["@emacs//file"],
 ) for x in range(1, UPPER_BOUND)]
 
+SYSBOX_EXEC_PROPERTIES = {
+    "container-image": "docker://645088952840.dkr.ecr.eu-west-1.amazonaws.com/engflow-ci/debian12-dind-x64@sha256:1389536c34990e6f49cb38575c2b4f9d08cd3a27e7c3e93c77b7af6260fc5f83",
+    "dockerRuntime": "sysbox-runc",
+    "Pool": "linux_sysbox_x64",
+    "dockerNetwork": "standard",
+}
+
+genrule(
+    name = "sysbox_cp_no_sudo",
+    srcs = ["test_input.txt"],
+    outs = ["sysbox_no_sudo.txt"],
+    cmd = "cp $(location test_input.txt) $@ && echo 'appended' >> $@",
+    exec_properties = SYSBOX_EXEC_PROPERTIES,
+    tags = ["manual"],
+)
+
+SYSBOX_ROOT_EXEC_PROPERTIES = {
+    "container-image": "docker://645088952840.dkr.ecr.eu-west-1.amazonaws.com/engflow-ci/sysbox-sudo-test@sha256:868e9c2cf3ed714191725630d115c15358097cbe9650ec312de7a2f69cdc80fd",
+    "dockerRuntime": "sysbox-runc",
+    "dockerRunAsRoot": "True",
+    "Pool": "linux_sysbox_x64",
+    "dockerNetwork": "standard",
+}
+
+genrule(
+    name = "sysbox_cp_as_root",
+    srcs = ["test_input.txt"],
+    outs = ["sysbox_root.txt"],
+    cmd = "cp $(location test_input.txt) $@ && echo 'appended' >> $@",
+    exec_properties = SYSBOX_ROOT_EXEC_PROPERTIES,
+    tags = ["manual"],
+)
+
 # Explicitlt specify the following target if
 # you want to add more load to the build.
 # Be aware that it downloads around 1.3GB.
diff --git a/genrules/test_input.txt b/genrules/test_input.txt
new file mode 100644
index 00000000..3b18e512
--- /dev/null
+++ b/genrules/test_input.txt
@@ -0,0 +1 @@
+hello world