diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d491260..340e74e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,17 +9,18 @@ on:
       - '.github/**'
       - '**.rs'
       - 'Cargo.*'
-      - 'Dockerfile'
       - 'docker-compose.yml'
   pull_request:
     branches: [ master ]
 
+env:
+  CARGO_TERM_COLOR: always
+
 jobs:
   test:
     name: Test
     runs-on: ubuntu-24.04
-    env:
-      CARGO_TERM_COLOR: always
+    if: false  # FIXME delete line when I am done figuring things out
     steps:
     - uses: actions/checkout@v4
     - name: Start services
@@ -46,3 +47,89 @@ jobs:
         token: ${{ secrets.CODECOV_TOKEN }}
         files: codecov.json
         fail_ci_if_error: true
+  build-rust:
+    name: Build Rust binary
+    runs-on: ubuntu-24.04
+    # FIXME uncomment line below when I am done figuring things out
+    # needs: [ test ]
+    strategy:
+      matrix:
+        target:
+        - aarch64-unknown-linux-musl
+        - x86_64-unknown-linux-musl
+    steps:
+    - uses: actions/checkout@v4
+    - name: Cache rust build
+      uses: Swatinem/rust-cache@v2
+    - name: Install cross-compilation tools
+      uses: taiki-e/setup-cross-toolchain-action@v1
+      with:
+        target: ${{ matrix.target }}
+    - name: Build
+      run: cargo build --release --locked
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: 'build__${{ matrix.target }}'
+        path: 'target/${{ matrix.target }}/release/oxidicom'
+        if-no-files-found: 'error'
+  build-docker:
+    name: Build container image
+    runs-on: ubuntu-24.04
+    needs: [ build-rust ]
+    # if: github.event_name == 'push'
+    steps:
+    - name: Download x86_64 binary
+      uses: actions/download-artifact@v4
+    - name: Print out all files
+      run: find -type f
+    - name: Move binaries
+      run: |
+        mkdir -vp dist/linux/amd64 dist/linux/arm64
+        mv -v build__x86_64-unknown-linux-musl/oxidicom dist/linux/amd64/oxidicom
+        mv -v build__aarch64-unknown-linux-musl/oxidicom dist/linux/arm64/oxidicom
+    - name: Create Dockerfile
+      run: |
+        cat > Dockerfile << EOF
+        # syntax=docker/dockerfile:1
+        FROM scratch
+        ARG TARGETPLATFORM
+        COPY ./dist/\$TARGETPLATFORM/oxidicom /oxidicom
+        CMD ["/oxidicom"]
+        EOF
+    - uses: docker/metadata-action@v5
+      id: meta
+      with:
+        images: |
+          docker.io/fnndsc/oxidicom
+          ghcr.io/fnndsc/oxidicom
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=raw,value=latest,enable={{is_default_branch}}
+    - uses: docker/setup-qemu-action@v3
+    - uses: docker/setup-buildx-action@v3
+    - name: Login to DockerHub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Build and push
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        push: true
+        file: ./Dockerfile
+        platforms: linux/amd64,linux/arm64
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max