This step is well-documented in the official docs.
You'll then need to apply halium_build.patch in order to disable verity:
cd build
wget https://gist.githubusercontent.com/Sergobot/64d063489ebda5075a95c31442531068/raw/0c799d923910c68d314715409f4ea4ca8fbb4c46/halium_build.patch
git apply halium_build.patch
rm halium_build.patch
cd ..
As of 08/01/2018 libcurl isn't downloaded by default. So, a couple more patches: repo_manifest.patch and halium_build_libcurl.patch
Apply them (you already know how to) in .repo/manifest and build directories respectively.
Finally, run repo sync -c again for these two last patches to take effect.
Now you're ready to build!
mka mkbootimg
mka halium-boot
mka systemimage
If you get any error, please report.
I (and many others) prefer using halium-install script by JBBgameich. You'll find usage instructions in the repo.
After you've pushed rootfs.img and system.img to your device, it's time to set things up for halium-boot to run.
First, while you're still in TWRP, rename /data/system.img to /data/android-rootfs.img and do touch /data/.writable_device_image.
Then follow the general halium-boot instructions.
After doing all the described steps you should be able to ssh into rootfs and the lxc container should run fine. If this is not the case, scream at @Sergobot in @halium chat in Telegram.