diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 85f758e3..1d51d327 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,7 +7,7 @@ stages:
   - setup
   - build
   - test
-  - docs
+  - publish
   - deploy
 
 setup:
@@ -65,7 +65,7 @@ scheduled-audit:
     - schedules
 
 pages:
-  stage: docs
+  stage: publish
   script:
     - npm run documentation
     - mv docs public
@@ -75,6 +75,29 @@ pages:
     paths:
       - public
 
+executable:
+  image: registry.gitlab.com/openstapps/projectmanagement/builder
+  stage: publish
+  variables:
+    DOCKER_DRIVER: overlay2
+  services:
+    - docker:dind
+  script:
+    - npm run build:prod
+    - export REGISTRY_BRANCH=$(.gitlab/ci/getRegistryBranch.sh "$CI_JOB_NAME")
+    - export CORE_VERSION=$(openstapps-projectmanagement get-used-version @openstapps/core)
+    - export IMAGETAG_BASE=$CI_REGISTRY_IMAGE/$REGISTRY_BRANCH
+    - export IMAGETAG_CORE_VERSION=$IMAGETAG_BASE:core-$CORE_VERSION
+    - export IMAGETAG_LATEST=$IMAGETAG_BASE:latest
+    - docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
+    - docker build -t $IMAGETAG_CORE_VERSION -t $IMAGETAG_LATEST -f Dockerfile.Executable .
+    - docker push $IMAGETAG_CORE_VERSION
+    - .gitlab/ci/pushAsLatestVersion.sh "$CI_COMMIT_REF_NAME" "$IMAGETAG_BASE"
+  only:
+    - /^(v[0-9]+\.[0-9]+\.[0-9]+|master|develop)$/
+  tags:
+    - docker
+
 review:
   stage: deploy
   script:
diff --git a/.gitlab/ci/getRegistryBranch.sh b/.gitlab/ci/getRegistryBranch.sh
new file mode 100755
index 00000000..0b71943f
--- /dev/null
+++ b/.gitlab/ci/getRegistryBranch.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+
+# script returns string with everything after the last colon of $1 input
+echo -n $1 | grep -oE '[^:]+$'
diff --git a/.gitlab/ci/getRegistryTag.sh b/.gitlab/ci/getRegistryTag.sh
new file mode 100755
index 00000000..d325ce19
--- /dev/null
+++ b/.gitlab/ci/getRegistryTag.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env sh
+
+# script returns semantical versioning string linke 2.0.0 (if $1 is v2.0.0) or $1
+if echo -n $1 | grep -Eq 'v[0-9]+\.[0-9]+\.[0-9]+'; then 
+  echo $(echo -n "$1" | cut -c 2-);
+else 
+  echo $1;
+fi
diff --git a/.gitlab/ci/pushAsLatestVersion.sh b/.gitlab/ci/pushAsLatestVersion.sh
new file mode 100755
index 00000000..22141ee2
--- /dev/null
+++ b/.gitlab/ci/pushAsLatestVersion.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env sh
+
+# If this is a pipeline of a version tag, also push this version 
+# as latest to the registry alias $2:latest
+if echo -n $1 | grep -Eq 'v[0-9]+\.[0-9]+\.[0-9]+'; then
+  docker push $2:latest;
+fi
diff --git a/.gitlab/ci/testCIScripts.sh b/.gitlab/ci/testCIScripts.sh
new file mode 100755
index 00000000..6cd7218a
--- /dev/null
+++ b/.gitlab/ci/testCIScripts.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env sh
+
+# test all CI scripts
+
+SCRIPT_DIR=$(dirname "$0")
+
+TAG_VERSION=$(sh $SCRIPT_DIR/getRegistryTag.sh "v1.0.0")
+TAG_TEST=$(sh $SCRIPT_DIR/getRegistryTag.sh "TEST")
+BRANCH_NAME=$(sh $SCRIPT_DIR/getRegistryBranch.sh "very:first:test")
+
+# Leaving out pushAsLatestVersion.sh as its controll flow
+# is based on the same condition as getRegistryTag.sh
+
+if [ $TAG_VERSION != "1.0.0" ]; then
+	echo "ERROR in CI SCRIPT: $SCRIPT_DIR/getRegistryTag.sh"
+	return 1
+fi
+
+if [ $TAG_TEST != "TEST" ]; then
+	echo "ERROR in CI SCRIPT: $SCRIPT_DIR/getRegistryTag.sh"
+	return 2
+fi
+
+if [ $BRANCH_NAME != "test" ]; then
+	echo "ERROR in CI SCRIPT: $SCRIPT_DIR/getRegistryBranch.sh"
+	return 3
+fi
+
+return 0