diff --git a/debos/overlays/initramfs-tools/etc/initramfs-tools/modules b/debos/overlays/initramfs-tools/etc/initramfs-tools/modules
new file mode 100644
index 0000000..b72e899
--- /dev/null
+++ b/debos/overlays/initramfs-tools/etc/initramfs-tools/modules
@@ -0,0 +1,14 @@
+# List of modules that you want to include in your initramfs.
+# They will be loaded at boot time in the order below.
+#
+# Syntax:  module_name [args ...]
+#
+# You must run update-initramfs(8) to effect this change.
+#
+# Examples:
+#
+# raid1
+# sd_mod
+drm
+vc4
+
diff --git a/debos/overlays/lightdm/etc/lightdm/lightdm.conf b/debos/overlays/lightdm/etc/lightdm/lightdm.conf
new file mode 100644
index 0000000..f65fbd6
--- /dev/null
+++ b/debos/overlays/lightdm/etc/lightdm/lightdm.conf
@@ -0,0 +1,169 @@
+#
+# General configuration
+#
+# start-default-seat = True to always start one seat if none are defined in the configuration
+# greeter-user = User to run greeter as
+# minimum-display-number = Minimum display number to use for X servers
+# minimum-vt = First VT to run displays on
+# lock-memory = True to prevent memory from being paged to disk
+# user-authority-in-system-dir = True if session authority should be in the system location
+# guest-account-script = Script to be run to setup guest account
+# logind-check-graphical = True to on start seats that are marked as graphical by logind
+# log-directory = Directory to log information to
+# run-directory = Directory to put running state in
+# cache-directory = Directory to cache to
+# sessions-directory = Directory to find sessions
+# remote-sessions-directory = Directory to find remote sessions
+# greeters-directory = Directory to find greeters
+# backup-logs = True to move add a .old suffix to old log files when opening new ones
+# dbus-service = True if LightDM provides a D-Bus service to control it
+#
+[LightDM]
+#start-default-seat=true
+#greeter-user=lightdm
+#minimum-display-number=0
+#minimum-vt=7
+#lock-memory=true
+#user-authority-in-system-dir=false
+#guest-account-script=guest-account
+#logind-check-graphical=false
+#log-directory=/var/log/lightdm
+#run-directory=/var/run/lightdm
+#cache-directory=/var/cache/lightdm
+#sessions-directory=/usr/share/lightdm/sessions:/usr/share/xsessions:/usr/share/wayland-sessions
+#remote-sessions-directory=/usr/share/lightdm/remote-sessions
+#greeters-directory=$XDG_DATA_DIRS/lightdm/greeters:$XDG_DATA_DIRS/xgreeters
+#backup-logs=true
+#dbus-service=true
+
+#
+# Seat configuration
+#
+# Seat configuration is matched against the seat name glob in the section, for example:
+# [Seat:*] matches all seats and is applied first.
+# [Seat:seat0] matches the seat named "seat0".
+# [Seat:seat-thin-client*] matches all seats that have names that start with "seat-thin-client".
+#
+# type = Seat type (local, xremote, unity)
+# pam-service = PAM service to use for login
+# pam-autologin-service = PAM service to use for autologin
+# pam-greeter-service = PAM service to use for greeters
+# xserver-backend = X backend to use (mir)
+# xserver-command = X server command to run (can also contain arguments e.g. X -special-option)
+# xmir-command = Xmir server command to run (can also contain arguments e.g. Xmir -special-option)
+# xserver-config = Config file to pass to X server
+# xserver-layout = Layout to pass to X server
+# xserver-allow-tcp = True if TCP/IP connections are allowed to this X server
+# xserver-share = True if the X server is shared for both greeter and session
+# xserver-hostname = Hostname of X server (only for type=xremote)
+# xserver-display-number = Display number of X server (only for type=xremote)
+# xdmcp-manager = XDMCP manager to connect to (implies xserver-allow-tcp=true)
+# xdmcp-port = XDMCP UDP/IP port to communicate on
+# xdmcp-key = Authentication key to use for XDM-AUTHENTICATION-1 (stored in keys.conf)
+# unity-compositor-command = Unity compositor command to run (can also contain arguments e.g. unity-system-compositor -special-option)
+# unity-compositor-timeout = Number of seconds to wait for compositor to start
+# greeter-session = Session to load for greeter
+# greeter-hide-users = True to hide the user list
+# greeter-allow-guest = True if the greeter should show a guest login option
+# greeter-show-manual-login = True if the greeter should offer a manual login option
+# greeter-show-remote-login = True if the greeter should offer a remote login option
+# user-session = Session to load for users
+# allow-user-switching = True if allowed to switch users
+# allow-guest = True if guest login is allowed
+# guest-session = Session to load for guests (overrides user-session)
+# session-wrapper = Wrapper script to run session with
+# greeter-wrapper = Wrapper script to run greeter with
+# guest-wrapper = Wrapper script to run guest sessions with
+# display-setup-script = Script to run when starting a greeter session (runs as root)
+# display-stopped-script = Script to run after stopping the display server (runs as root)
+# greeter-setup-script = Script to run when starting a greeter (runs as root)
+# session-setup-script = Script to run when starting a user session (runs as root)
+# session-cleanup-script = Script to run when quitting a user session (runs as root)
+# autologin-guest = True to log in as guest by default
+# autologin-user = User to log in with by default (overrides autologin-guest)
+# autologin-user-timeout = Number of seconds to wait before loading default user
+# autologin-session = Session to load for automatic login (overrides user-session)
+# autologin-in-background = True if autologin session should not be immediately activated
+# exit-on-failure = True if the daemon should exit if this seat fails
+#
+[Seat:*]
+#type=local
+#pam-service=lightdm
+#pam-autologin-service=lightdm-autologin
+#pam-greeter-service=lightdm-greeter
+#xserver-backend=
+#xserver-command=X
+#xmir-command=Xmir
+#xserver-config=
+#xserver-layout=
+#xserver-allow-tcp=false
+#xserver-share=true
+#xserver-hostname=
+#xserver-display-number=
+#xdmcp-manager=
+#xdmcp-port=177
+#xdmcp-key=
+#unity-compositor-command=unity-system-compositor
+#unity-compositor-timeout=60
+#greeter-session=example-gtk-gnome
+#greeter-hide-users=false
+#greeter-allow-guest=true
+#greeter-show-manual-login=false
+#greeter-show-remote-login=true
+#user-session=default
+#allow-user-switching=true
+#allow-guest=true
+#guest-session=
+#session-wrapper=lightdm-session
+#greeter-wrapper=
+#guest-wrapper=
+#display-setup-script=
+#display-stopped-script=
+#greeter-setup-script=
+#session-setup-script=
+#session-cleanup-script=
+#autologin-guest=false
+autologin-user=pi
+autologin-user-timeout=0
+#autologin-in-background=false
+#autologin-session=
+#exit-on-failure=false
+
+#
+# XDMCP Server configuration
+#
+# enabled = True if XDMCP connections should be allowed
+# port = UDP/IP port to listen for connections on
+# listen-address = Host/address to listen for XDMCP connections (use all addresses if not present)
+# key = Authentication key to use for XDM-AUTHENTICATION-1 or blank to not use authentication (stored in keys.conf)
+# hostname = Hostname to report to XDMCP clients (defaults to system hostname if unset)
+#
+# The authentication key is a 56 bit DES key specified in hex as 0xnnnnnnnnnnnnnn.  Alternatively
+# it can be a word and the first 7 characters are used as the key.
+#
+[XDMCPServer]
+#enabled=false
+#port=177
+#listen-address=
+#key=
+#hostname=
+
+#
+# VNC Server configuration
+#
+# enabled = True if VNC connections should be allowed
+# command = Command to run Xvnc server with
+# port = TCP/IP port to listen for connections on
+# listen-address = Host/address to listen for VNC connections (use all addresses if not present)
+# width = Width of display to use
+# height = Height of display to use
+# depth = Color depth of display to use
+#
+[VNCServer]
+#enabled=false
+#command=Xvnc
+#port=5900
+#listen-address=
+#width=1024
+#height=768
+#depth=8
diff --git a/debos/overlays/lxde-pi/home/pi/.config/lxpanel/LXDE/config b/debos/overlays/lxde-pi/home/pi/.config/lxpanel/LXDE/config
new file mode 100644
index 0000000..76228e2
--- /dev/null
+++ b/debos/overlays/lxde-pi/home/pi/.config/lxpanel/LXDE/config
@@ -0,0 +1,2 @@
+[Command]
+Logout=lxde-logout
diff --git a/debos/overlays/lxde-pi/home/pi/.config/lxpanel/LXDE/panels/panel b/debos/overlays/lxde-pi/home/pi/.config/lxpanel/LXDE/panels/panel
new file mode 100644
index 0000000..ff93ff3
--- /dev/null
+++ b/debos/overlays/lxde-pi/home/pi/.config/lxpanel/LXDE/panels/panel
@@ -0,0 +1,139 @@
+# lxpanel <profile> config file. Manually editing is not recommended.
+# Use preference dialog in lxpanel to adjust config when you can.
+
+Global {
+  edge=top
+  align=left
+  margin=0
+  widthtype=percent
+  width=100
+  height=26
+  transparent=1
+  tintcolor=#000000
+  alpha=101
+  setdocktype=1
+  setpartialstrut=1
+  autohide=0
+  heightwhenhidden=0
+  usefontcolor=1
+  fontcolor=#ffffff
+  background=0
+  backgroundfile=/usr/share/lxpanel/images/background.png
+}
+Plugin {
+  type=space
+  Config {
+    Size=2
+  }
+}
+Plugin {
+  type=menu
+  Config {
+    image=/usr/share/lxde/images/lxde-icon.png
+    system {
+    }
+    separator {
+    }
+    item {
+      command=run
+    }
+    separator {
+    }
+    item {
+      image=gnome-logout
+      command=logout
+    }
+  }
+}
+Plugin {
+  type=launchbar
+  Config {
+    Button {
+      id=pcmanfm.desktop
+    }
+    Button {
+      id=lxde-x-www-browser.desktop
+    }
+  }
+}
+Plugin {
+  type=space
+  Config {
+    Size=4
+  }
+}
+Plugin {
+  type=wincmd
+  Config {
+    Button1=iconify
+    Button2=shade
+  }
+}
+Plugin {
+  type=space
+  Config {
+    Size=4
+  }
+}
+Plugin {
+  type=pager
+  Config {
+  }
+}
+Plugin {
+  type=space
+  Config {
+    Size=4
+  }
+}
+Plugin {
+  type=taskbar
+  expand=1
+  Config {
+    tooltips=1
+    IconsOnly=0
+    AcceptSkipPager=1
+    ShowIconified=1
+    ShowMapped=1
+    ShowAllDesks=0
+    UseMouseWheel=1
+    UseUrgencyHint=1
+    FlatButton=0
+    MaxTaskWidth=150
+    spacing=1
+  }
+}
+Plugin {
+  type=volume
+  Config {
+    VolumeMuteKey=XF86AudioMute
+    VolumeDownKey=XF86AudioLowerVolume
+    VolumeUpKey=XF86AudioRaiseVolume
+  }
+}
+Plugin {
+  type=tray
+  Config {
+  }
+}
+Plugin {
+  type=dclock
+  Config {
+    ClockFmt=%R
+    TooltipFmt=%A %x
+    BoldFont=0
+    IconOnly=0
+    CenterText=0
+  }
+}
+Plugin {
+  type=launchbar
+  Config {
+    Button {
+      id=lxde-screenlock.desktop
+    }
+    Button {
+      id=lxde-logout.desktop
+    }
+  }
+}
diff --git a/debos/overlays/lxde-pi/home/pi/.config/lxpanel/launchtaskbar.cfg b/debos/overlays/lxde-pi/home/pi/.config/lxpanel/launchtaskbar.cfg
new file mode 100644
index 0000000..a3d0e52
--- /dev/null
+++ b/debos/overlays/lxde-pi/home/pi/.config/lxpanel/launchtaskbar.cfg
@@ -0,0 +1,4 @@
+[special_cases]
+synaptic=synaptic-pkexec
+soffice.bin=libreoffice
+x-terminal-emulator=lxterminal
diff --git a/debos/overlays/lxde-pi/home/pi/.config/pcmanfm/LXDE/desktop-items-0.conf b/debos/overlays/lxde-pi/home/pi/.config/pcmanfm/LXDE/desktop-items-0.conf
new file mode 100644
index 0000000..869c815
--- /dev/null
+++ b/debos/overlays/lxde-pi/home/pi/.config/pcmanfm/LXDE/desktop-items-0.conf
@@ -0,0 +1,14 @@
+[*]
+wallpaper_mode=crop
+wallpaper_common=1
+wallpaper=/home/pi/.config/pcmanfm/LXDE/pi_white.jpg
+desktop_bg=#000000
+desktop_fg=#ffffff
+desktop_shadow=#000000
+desktop_font=Sans 12
+show_wm_menu=0
+sort=mtime;ascending;
+show_documents=0
+show_trash=0
+show_mounts=0
+
diff --git a/debos/overlays/lxde-pi/home/pi/.config/pcmanfm/LXDE/pi_white.jpg b/debos/overlays/lxde-pi/home/pi/.config/pcmanfm/LXDE/pi_white.jpg
new file mode 100644
index 0000000..7dbeca8
Binary files /dev/null and b/debos/overlays/lxde-pi/home/pi/.config/pcmanfm/LXDE/pi_white.jpg differ
diff --git a/debos/raspberrypi-desktop_arm64.yaml b/debos/raspberrypi-desktop_arm64.yaml
new file mode 100644
index 0000000..03dc67c
--- /dev/null
+++ b/debos/raspberrypi-desktop_arm64.yaml
@@ -0,0 +1,76 @@
+{{- $image := or .image "raspberrypi-desktop_buster_arm64.img" -}}
+
+architecture: arm64
+
+actions:
+  - action: debootstrap
+    suite: "buster"
+    components:
+      - main
+      - contrib
+      - non-free
+    mirror: https://deb.debian.org/debian
+
+  - action: apt
+    recommends: false
+    packages: [ sudo, openssh-server, adduser, systemd-sysv, iproute2, net-tools, isc-dhcp-client, nano, raspi3-firmware, plymouth-label, desktop-base, lxde, xserver-xorg, linux-image-arm64 ]
+
+  - action: run
+    chroot: true
+    script: scripts/setup-user.sh
+
+  - action: overlay
+    source: overlays/lxde-pi
+
+  - action: overlay
+    source: overlays/lightdm
+
+  - action: overlay
+    source: overlays/initramfs-tools
+
+  - action: run
+    chroot: true
+    command: update-initramfs -u
+
+  - action: run
+    chroot: true
+    command: echo raspberrypi > /etc/hostname; echo "127.0.0.1  raspberrypi" > /etc/hosts
+
+  - action: run
+    chroot: true
+    command: echo "console=tty0 root=LABEL=root rw elevator=deadline fsck.repair=yes net.ifnames=0 cma=64M rootwait quiet splash" > /boot/firmware/cmdline.txt
+
+  - action: run
+    chroot: true
+    command: apt clean; rm -rf /var/lib/apt/lists
+
+  - action: image-partition
+    imagename: {{ $image }}
+    imagesize: 8GB
+    partitiontype: msdos
+    mountpoints:
+      - mountpoint: /
+        partition: root
+      - mountpoint: /boot/firmware
+        partition: firmware
+        options: [ x-systemd.automount ]
+    partitions:
+      - name: firmware
+        fs: fat32
+        start: 0%
+        end: 256MB
+      - name: root
+        fs: ext4
+        start: 256MB
+        end: 100%
+
+  - action: filesystem-deploy
+    description: Deploying filesystem onto image
+
+  - action: run
+    postprocess: true
+    command: bmaptool create {{ $image }} > {{ $image }}.bmap
+
+  - action: run
+    postprocess: true
+    command: gzip -f {{ $image }}
diff --git a/debos/scripts/setup-user.sh b/debos/scripts/setup-user.sh
new file mode 100755
index 0000000..f1c44f9
--- /dev/null
+++ b/debos/scripts/setup-user.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -e
+
+adduser --gecos pi --disabled-password pi
+adduser pi sudo
+echo "pi:pi" | chpasswd
+passwd -l root