diff --git a/.gitignore b/.gitignore
index b9be933..3df6439 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,5 +8,5 @@
 /pkg/*/*-x86_64-build.log
 /pkg/de-p1st-gnupg/duraconf/
 
-/archlive/
-/out/
+/build-archiso/out/
+/build-pkg/out/
diff --git a/.idea/arch.iml b/.idea/arch.iml
index 8227bef..a1dc974 100644
--- a/.idea/arch.iml
+++ b/.idea/arch.iml
@@ -3,7 +3,8 @@
   <component name="NewModuleRootManager" inherit-compiler-output="true">
     <exclude-output />
     <content url="file://$MODULE_DIR$">
-      <excludeFolder url="file://$MODULE_DIR$/archlive" />
+      <excludeFolder url="file://$MODULE_DIR$/build-archiso/out" />
+      <excludeFolder url="file://$MODULE_DIR$/build-pkg/out" />
     </content>
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />
diff --git a/build-archiso/Dockerfile b/build-archiso/Dockerfile
new file mode 100644
index 0000000..a8520af
--- /dev/null
+++ b/build-archiso/Dockerfile
@@ -0,0 +1,36 @@
+# Inspiration:
+# * https://github.com/ungoogled-software/ungoogled-chromium-archlinux/blob/master/.github/workflows/build/Dockerfile
+# * https://github.com/WhyNotHugo/docker-makepkg/blob/main/Dockerfile
+
+FROM archlinux:base-devel
+
+# Add de-p1st mirror ...
+RUN printf '\n[de-p1st]\nSigLevel = Optional TrustAll\nServer = https://arch.p1st.de\n' >> /etc/pacman.conf
+# ... and update mirrors + packages
+RUN pacman -Syu --noconfirm && \
+    pacman -S   --noconfirm archiso
+
+# Set packager
+RUN sed --in-place 's|^#PACKAGER=.*$|PACKAGER="Daniel Langbein <daniel@systemli.org>"|' /etc/makepkg.conf
+# Store built packages in /out/
+RUN sed --in-place 's|^#PKGDEST=.*$|PKGDEST=/out|' /etc/makepkg.conf
+
+# Create a normal user to build the ISO
+RUN useradd --create-home build
+RUN echo "build ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
+
+# Create output directory
+RUN mkdir -p /out
+
+# Continue execution (and CMD) as notroot:
+USER build
+WORKDIR /home/build
+
+# Auto-fetch GPG keys (to check signatures):
+RUN mkdir .gnupg && \
+    echo "keyserver-options auto-key-retrieve" > .gnupg/gpg.conf
+
+COPY run.sh /home/build/run.sh
+ENTRYPOINT [ "/bin/bash", "/home/build/run.sh" ]
+# Default arguments passed to /run.sh
+# CMD [ "clean" ]
diff --git a/build-archiso/docker-compose.yml b/build-archiso/docker-compose.yml
new file mode 100644
index 0000000..1935535
--- /dev/null
+++ b/build-archiso/docker-compose.yml
@@ -0,0 +1,18 @@
+version: '3.7'
+services:
+
+  # usage:
+  #  sudo docker-compose run archiso
+  archiso:
+    build: .
+
+    # command: ["clean"]
+
+    volumes:
+      - ./out:/out
+
+    ## interactive
+    #stdin_open: true # docker run -i
+    #tty: true        # docker run -t
+
+    privileged: true
diff --git a/build-archiso.sh b/build-archiso/run.sh
similarity index 66%
rename from build-archiso.sh
rename to build-archiso/run.sh
index 63436b8..f0cd259 100755
--- a/build-archiso.sh
+++ b/build-archiso/run.sh
@@ -4,7 +4,7 @@
 #
 # TODO: set custom welcome message in /etc/motd
 #
-BUILD_DIR=./archlive
+BUILD_DIR=/out
 
 PKGS=()
 PKGS+=('de-p1st-keyboard')  # german keyboard
@@ -15,8 +15,13 @@ PKGS+=('de-p1st-installer') # de-p1st-installer script
 
 ################################
 
+# Write-permission for user "build"
+sudo chown "build:wheel" /out
+
 function isEmptyDir() {
-  if [ -n "$(find "$DIR_TO_CHECK" -maxdepth 0 -type d -empty 2>/dev/null)" ]; then
+  # arg $1: directory to check
+
+  if [ -z "$(find "${1}" -maxdepth 0 -type d -empty 2>/dev/null)" ]; then
     # "Empty directory"
     return 0
   else
@@ -29,16 +34,15 @@ function isEmptyDir() {
 if [ -d "${BUILD_DIR}" ]; then
   if ! isEmptyDir "${BUILD_DIR}"; then
     if [ "$1" = "clean" ]; then
-      sudo rm -r "${BUILD_DIR}" || exit $?
-      mkdir -p "${BUILD_DIR}" || exit $?
+      sudo rm -r "${BUILD_DIR}"/* || exit $?
     else
-      echo "BUILD_DIR not empty";
-      echo "Run '$0 clean' to start a clean ISO build."
+      echo "BUILD_DIR not empty: ${BUILD_DIR}";
+      echo "Run with argument 'clean' to clean up BUILD_DIR and then continue building the ISO."
       exit 1;
     fi
   fi # else: BUILD_DIR exists and is empty :)
 elif ! mkdir -p "${BUILD_DIR}"; then
-  echo "Could not create BUILD_DIR";
+  echo "Could not create BUILD_DIR: ${BUILD_DIR}";
   exit 1;
 fi
 
@@ -46,15 +50,18 @@ fi
 # The releng profile is used to create the official monthly installation ISO
 PROFILE=/usr/share/archiso/configs/releng/
 if [ ! -d "${PROFILE}" ]; then
-  echo "Installing dependency 'archiso' with sudo ..."
-  sudo pacman -S --needed archiso || exit $?
+  echo "Dependency 'archiso' is missing. Please install this first!"
+  exit 1
 fi
 
 cp -r "$PROFILE" "$BUILD_DIR"/profile || exit $?
 
 # extend the builder's pacman.conf (add de-p1st mirrors)
 # https://wiki.archlinux.org/index.php/Archiso#Custom_local_repository
-cat "pkg/de-p1st-pacman/pacman.d/de-p1st" >>"$BUILD_DIR"/profile/pacman.conf || exit $?
+# cat ../pkg/de-p1st-pacman/pacman.d/de-p1st >>"$BUILD_DIR"/profile/pacman.conf || exit $?
+echo '[de-p1st]
+SigLevel = Optional TrustAll
+Server = https://arch.p1st.de' | sudo tee -a "$BUILD_DIR"/profile/pacman.conf || exit $?
 
 for PKG in "${PKGS[@]}"; do
   echo "${PKG}" >>"${BUILD_DIR}"/profile/packages.x86_64
diff --git a/Dockerfile b/build-pkg/Dockerfile
similarity index 100%
rename from Dockerfile
rename to build-pkg/Dockerfile
diff --git a/build-pkg-docker.sh b/build-pkg/build-pkg-docker.sh
similarity index 100%
rename from build-pkg-docker.sh
rename to build-pkg/build-pkg-docker.sh
diff --git a/build-pkg.sh b/build-pkg/build-pkg.sh
similarity index 92%
rename from build-pkg.sh
rename to build-pkg/build-pkg.sh
index 4573d8a..1309b2e 100755
--- a/build-pkg.sh
+++ b/build-pkg/build-pkg.sh
@@ -29,13 +29,13 @@ function build-pkg() {
   PKG="$1"
 
   # Check if PKGBUILD exists, otherwise skip
-  [ -f "pkg/${PKG}/PKGBUILD" ] || {
-    echo "Directory pkg/${PKG} does not contain a PKGBUILD file - skipping it!";
+  [ -f "../pkg/${PKG}/PKGBUILD" ] || {
+    echo "Directory ../pkg/${PKG} does not contain a PKGBUILD file - skipping it!";
     SKIPPED_PKGS+=("${PKG}");
     return 0;
   }
 
-  cd "pkg/${PKG}" || return $?
+  cd "../pkg/${PKG}" || return $?
 
   # Build and copy to /home/custompkgs
 #   build-with-makepkg || {
@@ -44,7 +44,7 @@ function build-pkg() {
     return 1
   }
 
-  cd ../..        || return $?
+  cd ../../build-pkg || return $?
 }
 
 function push-pkg() {
@@ -72,7 +72,7 @@ function main() {
   SKIPPED_PKGS=()
 
   if [ "$1" = "all" ]; then
-    for PKG in pkg/*; do
+    for PKG in ../pkg/*; do
       build-pkg "$(basename "${PKG}")" || return $?
     done
   elif [ "$#" -gt "0" ]; then
diff --git a/docker-compose.yml b/build-pkg/docker-compose.yml
similarity index 91%
rename from docker-compose.yml
rename to build-pkg/docker-compose.yml
index 71614ef..047dec5 100644
--- a/docker-compose.yml
+++ b/build-pkg/docker-compose.yml
@@ -8,7 +8,7 @@ services:
     command: ["de-p1st-font"]
 
     volumes:
-      - ./pkg:/pkg:ro
+      - ../pkg:/pkg:ro
       - ./out:/out
 
     # interactive
diff --git a/run.sh b/build-pkg/run.sh
similarity index 100%
rename from run.sh
rename to build-pkg/run.sh
diff --git a/pkg/de-p1st-installer/README.md b/pkg/de-p1st-installer/README.md
index 09188dc..5c5e453 100644
--- a/pkg/de-p1st-installer/README.md
+++ b/pkg/de-p1st-installer/README.md
@@ -7,7 +7,7 @@
 1) Build the ISO: Run script found in the base of this git repo:
 
 ```shell
-./build-archiso.sh
+./build-archiso/run.sh
 ```
 
 2) Boot into the live medium and (optionally) run `screen` (to be able to scroll back in case of any errors)
@@ -20,7 +20,7 @@ de-p1st-installer
 
 ### via official livemedium
 
-1) Boot into the live medium from [archlinux.org](archlinux.org)
+1) Boot into the live medium from [archlinux.org](https://archlinux.org)
 2) Add to `/etc/pacman.conf`:
 
 ```shell