diff --git a/.gitignore b/.gitignore
index 75d1871..dddecf9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 .cuddle/
+.env
diff --git a/_examples/actions/docker_action/Dockerfile b/_examples/actions/docker_action/Dockerfile
new file mode 100644
index 0000000..572de73
--- /dev/null
+++ b/_examples/actions/docker_action/Dockerfile
@@ -0,0 +1,8 @@
+FROM debian:bullseye-slim
+
+# Kraken relies on this path being the specified path
+WORKDIR /src/work/
+
+COPY entry.sh /src/script.sh
+
+CMD [ "/src/script.sh" ]
diff --git a/_examples/actions/docker_action/entry.sh b/_examples/actions/docker_action/entry.sh
new file mode 100755
index 0000000..11771f4
--- /dev/null
+++ b/_examples/actions/docker_action/entry.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -e
+
+echo "# README docker" > README.md
diff --git a/_examples/actions/docker_action/go.mod b/_examples/actions/docker_action/go.mod
new file mode 100644
index 0000000..248ba10
--- /dev/null
+++ b/_examples/actions/docker_action/go.mod
@@ -0,0 +1,11 @@
+module write_a_readme
+
+go 1.19
+
+require github.com/bitfield/script v0.20.2
+
+require (
+	bitbucket.org/creachadair/shell v0.0.7 // indirect
+	github.com/itchyny/gojq v0.12.7 // indirect
+	github.com/itchyny/timefmt-go v0.1.3 // indirect
+)
diff --git a/_examples/actions/docker_action/go.sum b/_examples/actions/docker_action/go.sum
new file mode 100644
index 0000000..234eb1e
--- /dev/null
+++ b/_examples/actions/docker_action/go.sum
@@ -0,0 +1,20 @@
+bitbucket.org/creachadair/shell v0.0.7 h1:Z96pB6DkSb7F3Y3BBnJeOZH2gazyMTWlvecSD4vDqfk=
+bitbucket.org/creachadair/shell v0.0.7/go.mod h1:oqtXSSvSYr4624lnnabXHaBsYW6RD80caLi2b3hJk0U=
+github.com/bitfield/script v0.20.2 h1:4DexsRtBILVMEn3EZwHbtJdDqdk43sXI8gM3F04JXgs=
+github.com/bitfield/script v0.20.2/go.mod h1:l3AZPVAtKQrL03bwh7nlNTUtgrgSWurpJSbtqspYrOA=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/itchyny/gojq v0.12.7 h1:hYPTpeWfrJ1OT+2j6cvBScbhl0TkdwGM4bc66onUSOQ=
+github.com/itchyny/gojq v0.12.7/go.mod h1:ZdvNHVlzPgUf8pgjnuDTmGfHA/21KoutQUJ3An/xNuw=
+github.com/itchyny/timefmt-go v0.1.3 h1:7M3LGVDsqcd0VZH2U+x393obrzZisp7C0uEe921iRkU=
+github.com/itchyny/timefmt-go v0.1.3/go.mod h1:0osSSCQSASBJMsIZnhAaF1C2fCBTJZXrnj37mG8/c+A=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/_examples/actions/docker_action/kraken.yml b/_examples/actions/docker_action/kraken.yml
new file mode 100644
index 0000000..f2c8dba
--- /dev/null
+++ b/_examples/actions/docker_action/kraken.yml
@@ -0,0 +1,11 @@
+apiVersion: git.front.kjuulh.io/kjuulh/kraken/blob/main/schema/v1
+name: write-a-readme
+select:
+  repositories:
+    - git@git.front.kjuulh.io:kjuulh/kraken-test.git
+      #  providers:
+      #    - gitea: https://git.front.kjuulh.io
+      #      organisation: "cibus"
+actions:
+  - type: docker-build
+    entry: Dockerfile
diff --git a/cmd/kraken/commands/process.go b/cmd/kraken/commands/process.go
index 342ebc4..1ffd16e 100644
--- a/cmd/kraken/commands/process.go
+++ b/cmd/kraken/commands/process.go
@@ -22,8 +22,8 @@ func CreateKrakenProcessCmd() *cobra.Command {
 					Path       string `json:"path"`
 				}{
 					Repository: "git@git.front.kjuulh.io:kjuulh/kraken.git",
-					Branch:     "feature/gitea-integration",
-					Path:       "_examples/actions/write_a_readme/",
+					Branch:     "feature/docker-action",
+					Path:       "_examples/actions/docker_action/",
 				})
 			if err != nil {
 				panic(err)
diff --git a/internal/actions/action.go b/internal/actions/action.go
index 3c6416e..bc9fdb4 100644
--- a/internal/actions/action.go
+++ b/internal/actions/action.go
@@ -30,6 +30,18 @@ func (a *Action) Execute(ctx context.Context, area *storage.Area) error {
 
 			zap.L().Debug("Execution done")
 
+		case "docker-build":
+			zap.L().Debug("Building docker-build")
+			runCmd, err := builders.NewDockerBuild(zap.L()).Build(ctx, a.SchemaPath, action.Entry)
+			if err != nil {
+				return err
+			}
+			err = runCmd(ctx, area.Path)
+			if err != nil {
+				return err
+			}
+			return nil
+
 		default:
 			return errors.New("could not determine action type")
 		}
diff --git a/internal/actions/builders/docker.go b/internal/actions/builders/docker.go
new file mode 100644
index 0000000..4120229
--- /dev/null
+++ b/internal/actions/builders/docker.go
@@ -0,0 +1,95 @@
+package builders
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapio"
+)
+
+type DockerBuild struct {
+	logger *zap.Logger
+}
+
+func NewDockerBuild(logger *zap.Logger) *DockerBuild {
+	return &DockerBuild{logger: logger}
+}
+
+type DockerRunCommand func(ctx context.Context, victimPath string) error
+
+func (g *DockerBuild) Build(ctx context.Context, modulePath, entryPath string) (DockerRunCommand, error) {
+	g.logger.Debug("Building docker image", zap.String("actiondir", modulePath), zap.String("entry", entryPath))
+
+	if _, err := os.Stat(fmt.Sprintf("%s/%s", modulePath, entryPath)); os.IsNotExist(err) {
+		return nil, errors.New("could not find entry")
+	}
+
+	b := make([]byte, 20)
+	_, err := rand.Reader.Read(b)
+	if err != nil {
+		return nil, err
+	}
+	tag := hex.EncodeToString(b)
+	buildDockerCmd := fmt.Sprintf("(cd %s; docker build -f %s --tag kraken/%s .)", modulePath, entryPath, tag)
+	g.logger.Debug("Running command", zap.String("command", buildDockerCmd))
+
+	cmd := exec.CommandContext(
+		ctx,
+		"/bin/bash",
+		"-c",
+		buildDockerCmd,
+	)
+
+	debugwriter := &zapio.Writer{
+		Log:   g.logger,
+		Level: zap.DebugLevel,
+	}
+	defer debugwriter.Close()
+
+	cmd.Stdout = debugwriter
+	cmd.Stderr = debugwriter
+	err = cmd.Start()
+	if err != nil {
+		return nil, err
+	}
+
+	err = cmd.Wait()
+	if err != nil {
+		return nil, err
+	}
+
+	g.logger.Debug("Docker image built!")
+
+	return func(ctx context.Context, victimPath string) error {
+		g.logger.Debug("Executing script", zap.String("victim", victimPath))
+
+		cmd := exec.CommandContext(
+			ctx,
+			"/bin/bash",
+			"-c",
+			fmt.Sprintf("docker run --rm -v %s/:/src/work/ kraken/%s", victimPath, tag),
+		)
+
+		runDockerWriter := &zapio.Writer{
+			Log:   g.logger,
+			Level: zap.DebugLevel,
+		}
+		defer runDockerWriter.Close()
+
+		cmd.Stdout = runDockerWriter
+		cmd.Stderr = runDockerWriter
+
+		err = cmd.Start()
+		if err != nil {
+			return err
+		}
+
+		return cmd.Wait()
+	}, nil
+}
diff --git a/internal/commands/process_repos.go b/internal/commands/process_repos.go
index ae8049d..f801240 100644
--- a/internal/commands/process_repos.go
+++ b/internal/commands/process_repos.go
@@ -168,6 +168,16 @@ func (pr *ProcessRepos) commit(ctx context.Context, area *storage.Area, repo *pr
 		return fmt.Errorf("could not add file: %w", err)
 	}
 
+	status, err := wt.Status()
+	if err != nil {
+		return err
+	}
+
+	if status.IsClean() {
+		pr.logger.Info("Returning early, as no modifications are detected")
+		return nil
+	}
+
 	err = pr.git.Commit(ctx, repo)
 	if err != nil {
 		return fmt.Errorf("could not get diff: %w", err)
@@ -175,15 +185,6 @@ func (pr *ProcessRepos) commit(ctx context.Context, area *storage.Area, repo *pr
 
 	dryrun := false
 	if !dryrun {
-		status, err := wt.Status()
-		if err != nil {
-			return err
-		}
-
-		if status.IsClean() {
-			pr.logger.Info("Returning early, as no modifications are detected")
-			return nil
-		}
 
 		err = pr.git.Push(ctx, repo)
 		if err != nil {
diff --git a/internal/gitproviders/gitea.go b/internal/gitproviders/gitea.go
index 8fa3690..fcc277a 100644
--- a/internal/gitproviders/gitea.go
+++ b/internal/gitproviders/gitea.go
@@ -2,7 +2,9 @@ package gitproviders
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"os"
 	"sync"
 
 	"code.gitea.io/sdk/gitea"
@@ -121,7 +123,15 @@ func (g *Gitea) getOrCreateClient(ctx context.Context, server string) (*gitea.Cl
 	client, ok := g.giteaClients[server]
 	if !ok || client == nil {
 		c, err := gitea.NewClient(server)
-		c.SetBasicAuth("kjuulh", "c0bd801cc9a7f2ed559ea45d603afc92f5443f19")
+		username, ok := os.LookupEnv("GITEA_USERNAME")
+		if !ok {
+			return nil, errors.New("missing environment variable GITEA_USERNAME")
+		}
+		apitoken, ok := os.LookupEnv("GITEA_API_TOKEN")
+		if !ok {
+			return nil, errors.New("missing environment variable GITEA_API_TOKEN")
+		}
+		c.SetBasicAuth(username, apitoken)
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/services/providers/git.go b/internal/services/providers/git.go
index 07018b6..45ed04e 100644
--- a/internal/services/providers/git.go
+++ b/internal/services/providers/git.go
@@ -2,6 +2,7 @@ package providers
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"time"
 
@@ -63,12 +64,12 @@ func NewGit(logger *zap.Logger, gitConfig *GitConfig, openPGP *signer.OpenPGP) *
 }
 
 func (g *Git) GetOriginHEADForRepo(ctx context.Context, gitRepo *GitRepo) (string, error) {
-	remote, err := gitRepo.repo.Remote("origin")
+	auth, err := g.GetAuth()
 	if err != nil {
 		return "", err
 	}
 
-	auth, err := g.GetAuth()
+	remote, err := gitRepo.repo.Remote("origin")
 	if err != nil {
 		return "", err
 	}
@@ -82,11 +83,16 @@ func (g *Git) GetOriginHEADForRepo(ctx context.Context, gitRepo *GitRepo) (strin
 
 	headRef := ""
 	for _, ref := range refs {
+		//g.logger.Debug(ref.String())
 		if !ref.Name().IsBranch() {
 			headRef = ref.Target().Short()
 		}
 	}
 
+	if headRef == "" {
+		return "", errors.New("no upstream HEAD branch could be found")
+	}
+
 	return headRef, nil
 }
 
@@ -107,7 +113,7 @@ func (g *Git) CloneBranch(ctx context.Context, storageArea *storage.Area, repoUr
 		Auth:              auth,
 		RemoteName:        "origin",
 		ReferenceName:     plumbing.NewBranchReferenceName(branch),
-		SingleBranch:      true,
+		SingleBranch:      false,
 		NoCheckout:        false,
 		Depth:             1,
 		RecurseSubmodules: 1,
@@ -118,7 +124,7 @@ func (g *Git) CloneBranch(ctx context.Context, storageArea *storage.Area, repoUr
 	}
 
 	repo, err := git.PlainCloneContext(ctx, storageArea.Path, false, &cloneOptions)
-	if err != nil {
+	if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
 		return nil, err
 	}
 
@@ -144,7 +150,7 @@ func (g *Git) Clone(ctx context.Context, storageArea *storage.Area, repoUrl stri
 		Auth:              auth,
 		RemoteName:        "origin",
 		ReferenceName:     "refs/heads/main",
-		SingleBranch:      true,
+		SingleBranch:      false,
 		NoCheckout:        false,
 		Depth:             1,
 		RecurseSubmodules: 1,
@@ -245,7 +251,7 @@ func (g *Git) CreateBranch(ctx context.Context, gitRepo *GitRepo) error {
 		InsecureSkipTLS:   false,
 		CABundle:          []byte{},
 	})
-	if err != nil {
+	if err != nil && !errors.Is(err, git.NoErrAlreadyUpToDate) {
 		return fmt.Errorf("could not pull from origin: %w", err)
 	}
 
@@ -287,12 +293,11 @@ func (g *Git) Push(ctx context.Context, gitRepo *GitRepo) error {
 		Auth:              auth,
 		Progress:          g.getProgressWriter(),
 		Prune:             false,
-		Force:             false,
+		Force:             true,
 		InsecureSkipTLS:   false,
 		CABundle:          []byte{},
 		RequireRemoteRefs: []config.RefSpec{},
 	})
-
 	if err != nil {
 		return err
 	}
diff --git a/roadmap.md b/roadmap.md
index ae23587..8c2a5af 100644
--- a/roadmap.md
+++ b/roadmap.md
@@ -20,7 +20,7 @@
 
 - [x] Setup a way to choose actions and predicates
 - [x] Allow instantiation of actions, kraken template repo etc.
-- [ ] Implement docker action
+- [x] Implement docker action
 - [ ] Providing query results
 - [x] Create pr for gitea provider
 - [ ] Think about some sort of isolation
diff --git a/scripts/run_server.sh b/scripts/run_server.sh
index 6fb5602..59ec179 100755
--- a/scripts/run_server.sh
+++ b/scripts/run_server.sh
@@ -2,4 +2,6 @@
 
 set -e
 
+export $(cat .env | xargs)
+
 go run cmd/server/server.go start