diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..f2c081b
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,12 @@
+.config
+.git
+.woodpecker
+.zed
+
+.env
+*.env
+docker-compose.yml
+README.md
+
+/meshtender
+/cmd/meshtender/meshtender
diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
new file mode 100644
index 0000000..766ad1f
--- /dev/null
+++ b/.woodpecker/build.yaml
@@ -0,0 +1,59 @@
+# Builds the OCI image and pushes it to the Forgejo registry. Runs only after
+# tests pass, and only on the main branch and on tags (not on pull requests).
+when:
+  - event: push
+    branch: main
+  - event: tag
+
+depends_on:
+  - test
+
+steps:
+  publish:
+    image: moby/buildkit:v0.18.1-rootless
+    environment:
+      DOCKER_CONFIG: /home/user/.docker
+      BUILDKITD_FLAGS: --oci-worker-no-process-sandbox
+    commands:
+      - |
+        buildctl-daemonless.sh build \
+          --frontend dockerfile.v0 \
+          --local context=. \
+          --local dockerfile=. \
+          --opt filename=Dockerfile \
+          --output type=image,name=git.leightha.us/ci/jleight/meshtender:${CI_COMMIT_SHA},push=true
+    backend_options: &buildkit
+      kubernetes:
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          seccompProfile:
+            type: Unconfined
+          apparmorProfile:
+            type: Unconfined
+        secrets:
+          - name: woodpecker-ci-registry
+            key: .dockerconfigjson
+            target:
+              file: /home/user/.docker/config.json
+    when:
+      - event: push
+        branch: main
+
+  publish-tag:
+    image: moby/buildkit:v0.18.1-rootless
+    environment:
+      DOCKER_CONFIG: /home/user/.docker
+      BUILDKITD_FLAGS: --oci-worker-no-process-sandbox
+    commands:
+      # On a git tag: strip a leading "v" so v1.2.3 -> 1.2.3.
+      - |
+        buildctl-daemonless.sh build \
+          --frontend dockerfile.v0 \
+          --local context=. \
+          --local dockerfile=. \
+          --opt filename=Dockerfile \
+          --output type=image,name=git.leightha.us/ci/jleight/meshtender:${CI_COMMIT_TAG##v},push=true
+    backend_options: *buildkit
+    when:
+      - event: tag
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..77abc38
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+
+# ---- build stage ----
+FROM golang:1.26.4-alpine AS build
+
+WORKDIR /src
+
+# Cache module downloads separately from source.
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+# Static build so the binary runs in a scratch/distroless image.
+# Migrations and web assets are embedded via go:embed, so the binary is self-contained.
+RUN CGO_ENABLED=0 go build \
+      -trimpath \
+      -ldflags "-s -w" \
+      -o /out/meshtender ./cmd/meshtender
+
+
+# ---- runtime stage ----
+FROM gcr.io/distroless/static-debian12:nonroot
+
+COPY --from=build /out/meshtender /usr/local/bin/meshtender
+
+EXPOSE 8080
+
+USER nonroot:nonroot
+
+ENTRYPOINT ["/usr/local/bin/meshtender"]