diff --git a/hosts/fu137.nix b/hosts/fu137.nix
index 3a29c0d..13e5c60 100644
--- a/hosts/fu137.nix
+++ b/hosts/fu137.nix
@@ -23,6 +23,9 @@
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
+  boot.kernel.sysctl."net.ipv4.ip_forward" = true; # Docker
+  virtualisation.docker.enable = true;
+
   networking.hostName = "fu137-4090-ML"; # Define your hostname.
   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
 
@@ -161,6 +164,53 @@
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;
 
+  # https://nixos.wiki/wiki/Gitlab_runner
+  # (see above) enabling ip_forward on the host machine is important for the docker container to be able to perform networking tasks (such as cloning the gitlab repo)
+  # the registrationConfigFile must contain the gitlab token for registering a gitlab-runner
+  services.gitlab-runner = {
+      enable = true;
+      services= {
+        # runner for building in docker via host's nix-daemon
+        # nix store will be readable in runner, might be insecure
+        nix = with lib;{
+          # File should contain at least these two variables:
+          # `CI_SERVER_URL`
+          # `REGISTRATION_TOKEN`
+          registrationConfigFile = toString ./path/to/ci-env; # 2
+          dockerImage = "alpine";
+          dockerVolumes = [
+            "/nix/store:/nix/store:ro"
+            "/nix/var/nix/db:/nix/var/nix/db:ro"
+            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          ];
+          dockerDisableCache = true;
+          preBuildScript = pkgs.writeScript "setup-container" ''
+            mkdir -p -m 0755 /nix/var/log/nix/drvs
+            mkdir -p -m 0755 /nix/var/nix/gcroots
+            mkdir -p -m 0755 /nix/var/nix/profiles
+            mkdir -p -m 0755 /nix/var/nix/temproots
+            mkdir -p -m 0755 /nix/var/nix/userpool
+            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+            mkdir -p -m 0700 "$HOME/.nix-defexpr"
+            . ${pkgs.nix}/etc/profile.d/nix-daemon.sh
+            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixos-20.09 nixpkgs # 3
+            ${pkgs.nix}/bin/nix-channel --update nixpkgs
+            ${pkgs.nix}/bin/nix-env -i ${concatStringsSep " " (with pkgs; [ nix cacert git openssh ])}
+          '';
+          environmentVariables = {
+            ENV = "/etc/profile";
+            USER = "root";
+            NIX_REMOTE = "daemon";
+            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+          };
+          tagList = [ "nix" ];
+        };
+      };
+    };
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave