diff --git a/.gitignore b/.gitignore
index e0d2b2a9..794b2f63 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 /ocic
 conmon/conmon
 conmon/conmon.o
+vendor/src/github.com/kubernetes-incubator/ocid
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..f526dd2c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,50 @@
+FROM golang:1.7.1
+
+# libseccomp in jessie is not _quite_ new enough -- need backports version
+RUN echo 'deb http://httpredir.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/backports.list
+
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    curl \
+    gawk \
+    iptables \
+    pkg-config \
+    libaio-dev \
+    libcap-dev \
+    libprotobuf-dev \
+    libprotobuf-c0-dev \
+    libseccomp2/jessie-backports \
+    libseccomp-dev/jessie-backports \
+    protobuf-c-compiler \
+    protobuf-compiler \
+    python-minimal \
+    --no-install-recommends
+
+# install bats
+RUN cd /tmp \
+    && git clone https://github.com/sstephenson/bats.git \
+    && cd bats \
+    && git reset --hard 03608115df2071fff4eaaff1605768c275e5f81f \
+    && ./install.sh /usr/local
+
+# install criu
+ENV CRIU_VERSION 1.7
+RUN mkdir -p /usr/src/criu \
+    && curl -sSL https://github.com/xemul/criu/archive/v${CRIU_VERSION}.tar.gz | tar -v -C /usr/src/criu/ -xz --strip-components=1 \
+    && cd /usr/src/criu \
+    && make install-criu
+
+# Install runc
+ENV RUNC_COMMIT cc29e3dded8e27ba8f65738f40d251c885030a28
+RUN set -x \
+	&& export GOPATH="$(mktemp -d)" \
+	&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \
+	&& cd "$GOPATH/src/github.com/opencontainers/runc" \
+	&& git checkout -q "$RUNC_COMMIT" \
+	&& make static BUILDTAGS="seccomp selinux" \
+	&& cp runc /usr/local/bin/runc \
+	&& rm -rf "$GOPATH"
+
+WORKDIR /go/src/github.com/kubernetes-incubator/ocid
+
+ADD . /go/src/github.com/kubernetes-incubator/ocid
diff --git a/Makefile b/Makefile
index 2c6f0d37..5f86abc1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,12 @@
 EPOCH_TEST_COMMIT ?= 7fc874e05e74faa81e7c423b6514fc5c474c6b34
+PROJECT := github.com/kubernetes-incubator/ocid
+GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null)
+GIT_BRANCH_CLEAN := $(shell echo $(GIT_BRANCH) | sed -e "s/[^[:alnum:]]/-/g")
+OCID_IMAGE := ocid_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN))
+OCID_LINK := ${CURDIR}/vendor/src/github.com/kubernetes-incubator/ocid
+OCID_LINK_DIR := ${CURDIR}/vendor/src/github.com/kubernetes-incubator
+OCID_INSTANCE := ocid_dev
+export GOPATH := ${CURDIR}/vendor
 
 default: help
 
@@ -6,6 +14,7 @@ help:
 	@echo "Usage: make <target>"
 	@echo
 	@echo " * 'binaries' - Build ocid, conmon and ocic"
+	@echo " * 'integration' - Execute integration tests"
 	@echo " * 'clean' - Clean artifacts"
 	@echo " * 'lint' - Execute the source code linter"
 
@@ -13,20 +22,41 @@ lint:
 	@echo "checking lint"
 	@./.tool/lint
 
+${OCID_LINK}:
+	mkdir -p ${OCID_LINK_DIR}
+	ln -sfn ${CURDIR} ${OCID_LINK}
+
 conmon:
 	make -C $@
 
-ocid:
+ocid: ${OCID_LINK}
 	go build -o ocid ./cmd/server/
 
-ocic:
+ocic: ${OCID_LINK}
 	go build -o ocic ./cmd/client/
 
 clean:
 	rm -f ocic ocid
+	rm -f ${OCID_LINK}
 	rm -f conmon/conmon.o conmon/conmon
 
-binaries: ocid ocic conmon
+ocidimage:
+	docker build -t ${OCID_IMAGE} .
+
+dbuild: ocidimage
+	docker run --name=${OCID_INSTANCE} --privileged ${OCID_IMAGE} make binaries
+	docker cp ${OCID_INSTANCE}:/go/src/github.com/kubernetes-incubator/ocid/ocid .
+	docker cp ${OCID_INSTANCE}:/go/src/github.com/kubernetes-incubator/ocid/ocic .
+	docker cp ${OCID_INSTANCE}:/go/src/github.com/kubernetes-incubator/ocid/conmon/conmon ./conmon/conmon
+	docker rm ${OCID_INSTANCE}
+
+integration: ocidimage
+	docker run -t --privileged --rm -v ${CURDIR}:/go/src/${PROJECT} ${OCID_IMAGE} make localintegration
+
+localintegration: binaries
+	./test/test_runner.sh
+
+binaries: ${OCID_LINK} ocid ocic conmon
 
 .PHONY: .gitvalidation
 # When this is running in travis, it will only check the travis commit range
diff --git a/test/helpers.bash b/test/helpers.bash
new file mode 100644
index 00000000..d14e7229
--- /dev/null
+++ b/test/helpers.bash
@@ -0,0 +1,80 @@
+#!/bin/bash
+
+# Root directory of integration tests.
+INTEGRATION_ROOT=$(dirname "$(readlink -f "$BASH_SOURCE")")
+
+# Test data path.
+TESTDATA="${INTEGRATION_ROOT}/../testdata"
+
+# Root directory of the repository.
+OCID_ROOT=${OCID_ROOT:-$(cd "$INTEGRATION_ROOT/../.."; pwd -P)}
+
+# Path of the ocid binary.
+OCID_BINARY=${OCID_BINARY:-${OCID_ROOT}/ocid/ocid}
+# Path of the ocic binary.
+OCIC_BINARY=${OCIC_BINARY:-${OCID_ROOT}/ocid/ocic}
+# Path of the conmon binary.
+CONMON_BINARY=${CONMON_BINARY:-${OCID_ROOT}/ocid/conmon/conmon}
+
+PATH=$PATH:$BATS_TMPDIR
+
+# Run ocid using the binary specified by $OCID_BINARY.
+# This must ONLY be run on engines created with `start_ocid`.
+function ocid() {
+	"$OCID_BINARY" "$@"
+}
+
+# Run ocic using the binary specified by $OCID_BINARY.
+function ocic() {
+	"$OCIC_BINARY" "$@"
+}
+
+# Communicate with Docker on the host machine.
+# Should rarely use this.
+function docker_host() {
+	command docker "$@"
+}
+
+# Retry a command $1 times until it succeeds. Wait $2 seconds between retries.
+function retry() {
+	local attempts=$1
+	shift
+	local delay=$1
+	shift
+	local i
+
+	for ((i=0; i < attempts; i++)); do
+		run "$@"
+		if [[ "$status" -eq 0 ]] ; then
+			return 0
+		fi
+		sleep $delay
+	done
+
+	echo "Command \"$@\" failed $attempts times. Output: $output"
+	false
+}
+
+# Waits until the given ocid becomes reachable.
+function wait_until_reachable() {
+	retry 15 1 "$OCIC_BINARY" runtimeversion
+}
+
+# Start ocid.
+function start_ocid() {
+	cp "$CONMON_BINARY" "$BATS_TMPDIR/conmon"
+	mkdir -p "$BATS_TMPDIR/ocid/containers"
+	mkdir -p "$BATS_TMPDIR/ocid/sandboxes"
+
+	"$OCID_BINARY" --debug --runtime /usr/local/bin/runc  --containerdir "$BATS_TMPDIR/ocid/containers" --sandboxdir "$BATS_TMPDIR/ocid/sandboxes" & OCID_PID=$!
+	wait_until_reachable
+}
+
+# Stop ocid.
+function stop_ocid() {
+	# TODO(runcom): why a greceful kill doesn't work?!
+	kill -9 "$OCID_PID"
+	# TODO(runcom): remove the whole /var/lib/ocid
+	rm -rf "$BATS_TMPDIR/ocid/{containers,sandboxes}"
+	# TODO(runcom): runc list and kill/delete everything!
+}
diff --git a/test/runtimeversion.bats b/test/runtimeversion.bats
new file mode 100644
index 00000000..434fd163
--- /dev/null
+++ b/test/runtimeversion.bats
@@ -0,0 +1,13 @@
+#!/usr/bin/env bats
+
+load helpers
+
+function teardown() {
+	stop_ocid
+}
+
+@test "ocic runtimeversion" {
+	start_ocid
+	ocic runtimeversion
+	[ "$status" -eq 0 ]
+}
diff --git a/test/test_runner.sh b/test/test_runner.sh
new file mode 100755
index 00000000..868df60e
--- /dev/null
+++ b/test/test_runner.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -e
+
+cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
+
+# Load the helpers.
+. helpers.bash
+
+function execute() {
+	>&2 echo "++ $@"
+	eval "$@"
+}
+
+# Tests to run. Defaults to all.
+TESTS=${@:-.}
+
+# Run the tests.
+execute time bats --tap $TESTS