diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..b355fcc9
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+*
+!build/
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 43d55990..06fef547 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -1,30 +1,79 @@
 name: Java CI
 
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - "*"
+    tags:
+      - "*"
+  pull_request:
+    branches:
+      - "*"
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-      with:
-        submodules: recursive
-        fetch-depth: 0 # needed for versioning
-    - name: Set up JDK 1.17
-      uses: actions/setup-java@v1
-      with:
-        java-version: 17
-    - uses: actions/cache@v2
-      with:
-        path: |
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-        key: "${{ runner.os }}-bluemap-${{ hashFiles('**/*.gradle*') }}"
-        restore-keys: |
-          ${{ runner.os }}-bluemap-
-    - name: Build with Gradle
-      run: ./gradlew clean test build
-    - uses: actions/upload-artifact@v2
-      with:
-        name: artifacts
-        path: build/release/*
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+          fetch-depth: 0 # needed for versioning
+      - name: Set up JDK 1.17
+        uses: actions/setup-java@v1
+        with:
+          java-version: 17
+      - uses: actions/cache@v2
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: "${{ runner.os }}-bluemap-${{ hashFiles('**/*.gradle*') }}"
+          restore-keys: |
+            ${{ runner.os }}-bluemap-
+      - name: Build with Gradle
+        run: ./gradlew clean test build
+      - uses: actions/upload-artifact@v2
+        with:
+          name: artifacts
+          path: build/release/*
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - uses: actions/download-artifact@v3
+        with:
+          name: artifacts
+          path: build/release
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Docker metadata
+        id: metadata
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') }}
+            type=raw,value={{branch}}
+            type=raw,value={{tag}},enable=${{ startsWith(github.ref, 'refs/tags/') }}
+          flavor: |
+            latest=false
+      - name: Build and push
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          push: ${{ github.event_name != 'pull_request' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..4f1cd863
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,10 @@
+FROM eclipse-temurin:17-jre-alpine
+
+WORKDIR /app
+
+RUN apk update && \
+    apk upgrade
+
+COPY build/release/*-cli.jar cli.jar
+
+ENTRYPOINT [ "java", "-jar", "cli.jar" ]