diff --git a/WORKSPACE b/WORKSPACE
index c900302..e680dc3 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -39,3 +39,9 @@
 go_register_toolchains(version = "1.17.2")
 
 gazelle_dependencies()
+
+load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
+
+# This sets up some common toolchains for building targets. For more details, please see
+# https://bazelbuild.github.io/rules_foreign_cc/0.9.0/flatten.html#rules_foreign_cc_dependencies
+rules_foreign_cc_dependencies()
diff --git a/external/socat.BUILD b/external/socat.BUILD
new file mode 100644
index 0000000..4f3f855
--- /dev/null
+++ b/external/socat.BUILD
@@ -0,0 +1,47 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(
+        include = ["**"],
+        exclude = ["*.bazel"],
+    ),
+)
+
+configure_make(
+    name = "socat",
+    env = select({
+        "@platforms//os:macos": {"AR": ""},
+        "//conditions:default": {},
+    }),
+    lib_source = ":all_srcs",
+    out_binaries = ["socat"],
+    visibility = ["//visibility:public"],
+)
+
+# load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
+# load("@aspect_bazel_lib//lib:expand_make_vars.bzl", "expand_template")
+
+# expand_template(
+#     name = "fix_socat",
+#     out = "main.c",
+#     substitutions = {
+#         "#include \"./VERSION\"": "\"1.7.4.3\"",
+#     },
+#     template = "socat.c",
+# )
+
+# copy_file(
+#     name = "config",
+#     src = "config.h.in",
+#     out = "config.h",
+# )
+
+# cc_binary(
+#     name = "socat",
+#     srcs = glob(["*.h"]) + [
+#         "config.h",
+#         "main.c",
+#         "xioopts.c",
+#     ],
+# )
diff --git a/lib/repositories.bzl b/lib/repositories.bzl
index 8482c9a..e6d719f 100644
--- a/lib/repositories.bzl
+++ b/lib/repositories.bzl
@@ -28,6 +28,21 @@
         ],
     )
 
+    http_archive(
+        name = "socat",
+        build_file = "socat.BUILD",
+        sha256 = "d697245144731423ddbbceacabbd29447089ea223e9a439b28f9ff90d0dd216e",
+        strip_prefix = "socat-1.7.4.3",
+        urls = ["http://www.dest-unreach.org/socat/download/socat-1.7.4.3.tar.gz"],
+    )
+
+    http_archive(
+        name = "rules_foreign_cc",
+        sha256 = "2a4d07cd64b0719b39a7c12218a3e507672b82a97b98c6a89d38565894cf7c51",
+        strip_prefix = "rules_foreign_cc-0.9.0",
+        url = "https://github.com/bazelbuild/rules_foreign_cc/archive/refs/tags/0.9.0.tar.gz",
+    )
+
     if override_local_config_platform:
         local_config_platform(
             name = "local_config_platform",
diff --git a/lib/wrap_binary.bzl b/lib/wrap_binary.bzl
index 0b25340..7aa56c7 100644
--- a/lib/wrap_binary.bzl
+++ b/lib/wrap_binary.bzl
@@ -64,6 +64,10 @@
 def tty_binary(name, binary, runfiles_manifest_key, **kwargs):
     """Wrap a binary such that it sees a tty attached to its stdin
 
+    FIXME: document
+    load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
+    rules_foreign_cc_dependencies()
+
     Args:
         name: Name of the rule
         binary: Label of an executable target to wrap