diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 0000000..98c812d
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,51 @@
+name: build-and-push
+
+# CI/CD-pipeline demo (it-admin-3g4): build -> push naar de lokale registry.
+# De act_runner (crafity-qnap-runner) draait deze job in zijn DinD.
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build-push:
+    runs-on: alpine
+    container:
+      image: alpine:latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install docker CLI
+        run: apk add --no-cache docker-cli
+
+      - name: Registry login
+        env:
+          REG_USER: ${{ secrets.REGISTRY_USER }}
+          REG_PW: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "$REG_PW" | docker login 10.0.0.18:5000 -u "$REG_USER" --password-stdin
+
+      - name: Build image
+        run: docker build -t 10.0.0.18:5000/ci-pipeline-demo:${{ github.sha }} -t 10.0.0.18:5000/ci-pipeline-demo:latest .
+
+      - name: Push image
+        run: |
+          docker push 10.0.0.18:5000/ci-pipeline-demo:${{ github.sha }}
+          docker push 10.0.0.18:5000/ci-pipeline-demo:latest
+
+      # ---------------------------------------------------------------------
+      # DEPLOY-ROUTE (per repo instelbaar):
+      #
+      # Route A (Action deployt direct) - uncomment voor instant deploy.
+      # Vereist dat de runner de doel-container-engine bereikt. Alleen voor
+      # vertrouwde repos (geeft CI effectief host-toegang).
+      #   - name: Deploy (route A)
+      #     run: |
+      #       docker pull 10.0.0.18:5000/ci-pipeline-demo:latest
+      #       docker rm -f ci-pipeline-demo || true
+      #       docker run -d --name ci-pipeline-demo 10.0.0.18:5000/ci-pipeline-demo:latest
+      #
+      # Route B (Dockhand deployt) - GEEN deploy-stap hier. Zet op de doel-container
+      # het label dockhand.update=true; Dockhand pollt de registry en deployt met
+      # safe-pull + rollback. Trager (poll-interval) maar met veiligheidsklep.
+      # ---------------------------------------------------------------------
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..2e20b23
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,4 @@
+FROM alpine:latest
+LABEL ci-demo="true"
+COPY hello.txt /hello.txt
+CMD ["cat", "/hello.txt"]
diff --git a/hello.txt b/hello.txt
new file mode 100644
index 0000000..4c7e099
--- /dev/null
+++ b/hello.txt
@@ -0,0 +1 @@
+Gitea Actions CI/CD demo - gebouwd door de act_runner