Yeah, the trick is to do the disk-install steps manually, under a Hijack kernel, rather than using the limited builder image.

Someday.. someday..