diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..e838ad9
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+.git
+/target
+.env
+.env.*
+.opencode
+.playwright-mcp
+**/*.rs.bk
diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
new file mode 100644
index 0000000..6e6e888
--- /dev/null
+++ b/.gitea/workflows/build.yaml
@@ -0,0 +1,42 @@
+name: CI
+on:
+  push:
+    tags:
+      - 'release/*'
+
+jobs:
+  build_and_push_docker_image:
+    name: "Build and push docker image"
+    runs-on: hostinger
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Gitea container registry
+        uses: docker/login-action@v3
+        with:
+          registry: gitea.woggioni.net
+          username: woggioni-opencode-agent
+          password: ${{ secrets.PUBLISHER_TOKEN }}
+      - name: Extract metadata for image tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: gitea.woggioni.net/woggioni/hermes
+          flavor: latest=false
+          tags: |
+            type=match,pattern=release/(.*),group=1
+            type=raw,value=latest
+      - name: Build and push docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          builder: multiplatform-builder
+          file: Dockerfile
+          platforms: linux/amd64
+          push: true
+          pull: true
+          tags: ${{ steps.meta.outputs.tags }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..5a5f811
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1
+
+FROM rust:1-slim AS builder
+
+ARG RUST_TARGET=x86_64-unknown-linux-musl
+
+RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' \
+        /etc/apt/sources.list.d/debian.sources 2>/dev/null || true \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends musl-tools ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add "${RUST_TARGET}"
+
+WORKDIR /app
+COPY Cargo.toml Cargo.lock ./
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    mkdir -p src \
+ && printf 'fn main() {}' > src/main.rs \
+ && cargo fetch --locked --target "${RUST_TARGET}"
+
+COPY src ./src
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo build --release --locked --target "${RUST_TARGET}" \
+ && mkdir -p /out \
+ && cp "/app/target/${RUST_TARGET}/release/hermes" /out/hermes
+
+FROM scratch AS runtime
+
+COPY --from=builder /out/hermes /usr/local/bin/hermes
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
+ENV HERMES_CONFIG_PATH=/etc/hermes/hermes.yaml
+WORKDIR /etc/hermes
+USER 65532:65532
+EXPOSE 8080
+ENTRYPOINT ["/usr/local/bin/hermes"]
diff --git a/README.md b/README.md
index c82bff8..7174f7b 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,31 @@ curl --proxy http://127.0.0.1:8080 http://example.com/
 curl --proxy http://127.0.0.1:8080 https://example.com/
 ```
 
+## Docker
+
+The root `Dockerfile` builds a statically linked musl binary and packages it in a non-root `scratch` image with CA certificates. No configuration or credentials are included in the image.
+
+```sh
+docker build -t hermes:local .
+```
+
+Mount a configuration file read-only at `/etc/hermes/hermes.yaml`. Inside the container, set `listen_addr` to `0.0.0.0:8080` so the published port is reachable:
+
+```sh
+docker run --rm \
+  -p 127.0.0.1:8080:8080 \
+  -v "$PWD/hermes.yaml:/etc/hermes/hermes.yaml:ro" \
+  hermes:local
+```
+
+The image sets `HERMES_CONFIG_PATH` to the mount location. Ensure the mounted file is readable by the numeric non-root container user. ACL `networks` rules see the container-network peer address, which may differ from the original host or external client address.
+
+The `scratch` runtime contains no shell or healthcheck utility. Use `docker run --rm hermes:local --version` to verify the binary starts.
+
+### Publishing
+
+The Gitea workflow in `.gitea/workflows/build.yaml` builds and publishes `linux/amd64` images to `gitea.woggioni.net/woggioni/hermes` when a tag matching `release/*` is pushed. For example, `release/v0.2.0` publishes `v0.2.0` and `latest` tags. The repository must define the `PUBLISHER_TOKEN` secret used for registry authentication.
+
 ## YAML configuration
 
 ```yaml