app/factorio: build docker image
diff --git a/WORKSPACE b/WORKSPACE
index 16110c7..810ddad 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -44,11 +44,37 @@
 
 # Docker rules
 
-http_archive(
+git_repository(
     name = "io_bazel_rules_docker",
-    sha256 = "aed1c249d4ec8f703edddf35cbe9dfaca0b5f5ea6e4cd9e83e99f3b0d1136c3d",
-    strip_prefix = "rules_docker-0.7.0",
-    urls = ["https://github.com/bazelbuild/rules_docker/archive/v0.7.0.tar.gz"],
+    # Invoke puller.par with python2
+    # TODO(q3k): use upstream when py2/py3 bazel madness if fully fixed
+    remote = "https://github.com/q3k/rules_docker",
+    commit = "4642a2a7775e5713596bd6e37758735a0f38aa6e",
+)
+load(
+    "@io_bazel_rules_docker//repositories:repositories.bzl",
+    container_repositories = "repositories",
+)
+container_repositories()
+
+# Docker base images
+
+load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
+container_pull(
+    name = "prodimage-bionic",
+    registry = "index.docker.io",
+    repository = "library/ubuntu",
+    tag = "bionic-20190515",
+    digest = "sha256:b36667c98cf8f68d4b7f1fb8e01f742c2ed26b5f0c965a788e98dfe589a4b3e4",
+)
+
+# HTTP stuff from the Internet
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+http_file(
+	name = "factorio-headless",
+    urls = ["https://factorio.com/get-download/0.16.51/headless/linux64"],
+	sha256 = "6cb09f5ac87f16f8d5b43cef26c0ae26cc46a57a0382e253dfda032dc5bb367f",
+	downloaded_file_path = "factorio.tar.xz",
 )
 
 # Go rules
diff --git a/app/factorio/BUILD b/app/factorio/BUILD
new file mode 100644
index 0000000..dc5dfd5
--- /dev/null
+++ b/app/factorio/BUILD
@@ -0,0 +1,33 @@
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
+
+container_image(
+    name="latest",
+    base="@prodimage-bionic//image",
+	tars = ["@factorio-headless//file"],
+	files = [":entrypoint.sh"],
+	directory = "/",
+	entrypoint = ["/entrypoint.sh"],
+)
+
+# Totally broken right now because google/containerregistry doesn't handle
+# /usr/bin/env python == python3.
+#container_push(
+#    name = "push_latest",
+#    image = ":latest",
+#    format = "Docker",
+#    registry = "registry.k0.hswaw.net",
+#    repository = "app/factorio",
+#    tag = "latest",
+#)
+# So this is a replacement hack.
+genrule(
+	name = "push_latest",
+	srcs = [":latest"],
+	outs = ["version.sh"],
+	executable = True,
+	cmd = """
+		docker tag bazel/app/factorio:latest registry.k0.hswaw.net/app/factorio:latest
+        docker push registry.k0.hswaw.net/app/factorio:latest
+		echo -ne "#!/bin/sh\necho Tagged.\n" > $(OUTS)
+	""",
+)
diff --git a/app/factorio/entrypoint.sh b/app/factorio/entrypoint.sh
new file mode 100644
index 0000000..8077a1c
--- /dev/null
+++ b/app/factorio/entrypoint.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+echo "entrypoint.sh starting..."
+
+if [ ! -d /data ]; then
+    echo "/data is not mounted, exiting."
+    exit 1
+fi
+
+cd /data
+
+if [ ! -f /data/game.zip ]; then
+    echo "No save game, creating new..."
+    /factorio/bin/x64/factorio --create game
+fi
+
+echo "Running with args: $@"
+exec /factorio/bin/x64/factorio --start-server game "$@"
diff --git a/app/registry/prod.jsonnet b/app/registry/prod.jsonnet
index a7e1f5e..9b30d37 100644
--- a/app/registry/prod.jsonnet
+++ b/app/registry/prod.jsonnet
@@ -154,6 +154,11 @@
                         comment: "q3k and inf can mange 'vms' docker images",
                     },
                     {
+                        match: {account: "q3k", name: "app/factorio"},
+                        actions: ["*"],
+                        comment: "q3k can mange 'app/factorio' docker images",
+                    },
+                    {
                         match: {account: "/.+/", name: "${account}/*"},
                         actions: ["*"],
                         comment: "Logged in users have full access to images that are in their 'namespace'",