diff --git a/machines/loc1cli/attach.sh b/machines/loc1cli/attach.sh
new file mode 100755
index 0000000..9d0b686
--- /dev/null
+++ b/machines/loc1cli/attach.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+set -eu
+. ./lib.shs
+. machines/$mach/opts.shs
+
+nsenter --wdns=$nethorror_root $namespaces "$@"
diff --git a/machines/loc1cli/opts.shs b/machines/loc1cli/opts.shs
new file mode 100644
index 0000000..f0998ef
--- /dev/null
+++ b/machines/loc1cli/opts.shs
@@ -0,0 +1,3 @@
+#!/bin/false
+
+namespaces="--net=./state/$mach/netns --mount=./state/$mach/mntns"
diff --git a/machines/loc1cli/run-shim.sh b/machines/loc1cli/run-shim.sh
new file mode 100755
index 0000000..2f42dd8
--- /dev/null
+++ b/machines/loc1cli/run-shim.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -eu
+. ./lib.shs
+
+ensure_started
+attach machines/$mach/setup.sh
diff --git a/machines/loc1cli/setup.sh b/machines/loc1cli/setup.sh
new file mode 100755
index 0000000..5530869
--- /dev/null
+++ b/machines/loc1cli/setup.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+. ./lib.shs
+
+# typically: bring up the networks
+ip link set dev lo up
+
+# TODO: DHCP client!
+ip addr add 192.168.0.2/24 dev wifi
+# No IPv6 at public spaces lol (but we should try obtaining it anyway!
+ip link set dev wifi up
+ip route add default via 192.168.0.1 dev wifi
diff --git a/machines/loc1cli/start.sh b/machines/loc1cli/start.sh
new file mode 100755
index 0000000..6d71c67
--- /dev/null
+++ b/machines/loc1cli/start.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+. ./lib.shs
+. machines/$mach/opts.shs
+
+setup_statedir
+
+unshare $namespaces /bin/true # just create the namespaces
+
+# TODO: make it virt_wifi (need to read iproute2 src…)
+veth_to_bridge wifi loc1_cli ve_loc1_cli1