You're right, switching from := to ?= would work (with sudo -E), yet I wish there would be a simple way to both add and remove tags. Plus, we want to get those from shell env.

Perhaps something like this:

@@ -11,9 +11,12 @@ GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null)
 GIT_BRANCH_CLEAN := $(shell echo $(GIT_BRANCH) | sed -e "s/[^[:alnum:]]/-/g")
 RUNC_IMAGE := runc_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN))
 PROJECT := github.com/opencontainers/runc
-EXTRA_BUILDTAGS :=
+RUNC_BUILDTAGS ?=
 BUILDTAGS := seccomp urfave_cli_no_docs
-BUILDTAGS += $(EXTRA_BUILDTAGS)
+# Tags prefixed with - in RUNC_BUILDTAGS are removed; others are added.
+BUILDTAGS_REMOVE := $(patsubst -%,%,$(filter -%,$(RUNC_BUILDTAGS)))
+BUILDTAGS_ADD    := $(filter-out -%,$(RUNC_BUILDTAGS))
+BUILDTAGS := $(filter-out $(BUILDTAGS_REMOVE),$(BUILDTAGS)) $(BUILDTAGS_ADD)
 
 COMMIT := $(shell git describe --dirty --long --always)
 EXTRA_VERSION :=

and also fix README accordingly:

@@ -94,26 +94,22 @@ Bear in mind to include some separator for readability.
 
 `runc` supports optional build tags for compiling support of various features,
 with some of them enabled by default (see `BUILDTAGS` in top-level `Makefile`).
-
-To change build tags from the default, set the `BUILDTAGS` variable for make,
-e.g. to disable seccomp:
-
-```bash
-make BUILDTAGS=""
-```
-
-To add some more build tags to the default set, use the `EXTRA_BUILDTAGS`
-make variable, e.g. to disable checkpoint/restore:
-
-```bash
-make EXTRA_BUILDTAGS="runc_nocriu"
-```
+The following tags are supported:
 
 | Build Tag     | Feature                               | Enabled by Default | Dependencies        |
 |---------------|---------------------------------------|--------------------|---------------------|
 | `seccomp`     | Syscall filtering using `libseccomp`. | yes                | `libseccomp`        |
 | `runc_nocriu` | **Disables** runc checkpoint/restore. | no                 | `criu`              |
 
+To add or remove build tags from the default set, use the `RUNC_BUILDTAGS`
+make or shell variable. Tags prefixed with `-` are removed from the default set;
+others are added. For example:
+
+```bash
+# Remove criu and seccomp support.
+make RUNC_BUILDTAGS="runc_nocriu -seccomp"
+```
+
 The following build tags were used earlier, but are now obsoleted:
  - **runc_nodmz** (since runc v1.2.1 runc dmz binary is dropped)
  - **nokmem** (since runc v1.0.0-rc94 kernel memory settings are ignored)

The worst part here is I renamed EXTRA_BUILDTAGS to RUNC_BUILDTAGS. Guess we can still honor EXTRA_BUILDTAGS for backward compatibility).

The best part is you can e.g. say export RUNC_BUILDTAGS=runc_nocriu in your ~/.profile if you hate CRIU and forget about it.

Originally posted by @kolyshkin in #5103 (comment)