diff --git a/devtools/gerrit/BUILD b/devtools/gerrit/BUILD
new file mode 100644
index 0000000..d9170c0
--- /dev/null
+++ b/devtools/gerrit/BUILD
@@ -0,0 +1,33 @@
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
+
+container_image(
+    name="with_plugins",
+    base="@gerrit-3.0.0//image",
+    files = [
+        "//devtools/gerrit/gerrit-oauth-provider:gerrit-oauth-provider",
+    ],
+    # we cannot drop it directly in /var/gerrit/plugins as that changes the
+    # directory owner to 0:0 and then breaks the gerrit installer that wants
+    # to overwrite plugins.
+    directory = "/var/gerrit-plugins",
+)
+container_image(
+    name="3.0.0-r7",
+    base=":with_plugins",
+    files = [":entrypoint.sh"],
+    directory = "/",
+    entrypoint = ["/entrypoint.sh"],
+)
+
+genrule(
+    name = "push_latest",
+    srcs = [":3.0.0-r7"],
+    outs = ["version.sh"],
+    executable = True,
+    cmd = """
+        tag=3.0.0-r7
+        docker tag bazel/devtools/gerrit:$$tag registry.k0.hswaw.net/devtools/gerrit:$$tag
+        docker push registry.k0.hswaw.net/devtools/gerrit:$$tag
+        echo -ne "#!/bin/sh\necho Pushed $$tag.\n" > $(OUTS)
+    """,
+)