gcc/libssp's configure script runs checks for flags that clang doesn't implement. We actually just need to set a few HAVE defines and compile the .c sources, so just check out this subdirectory using svn and build it using a custom makefile.
Keep the old dockerfile with a different file name, for easier testing/debugging (where later steps can be tweaked without rebuilding everything).
Martin Storsjö