diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..4d88a54
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+target/
+test/
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..c214e32
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,53 @@
+name: release
+on:
+  release:
+    types: [published]
+  
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repo
+        uses: actions/checkout@v3
+      - name: Prepare
+        id: prep
+        run: |
+          BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
+          VERSION=sha-${GITHUB_SHA::8}
+          if [[ $GITHUB_REF == refs/tags/* ]]; then
+            VERSION=${GITHUB_REF/refs\/tags\//}
+          fi
+          echo "BUILD_DATE=${BUILD_DATE}" >> $GITHUB_OUTPUT
+          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
+      - name: Get GitHub Tag
+        id: get_tag
+        run: |
+          echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+      - name: Cache container layers
+        uses: actions/cache@v3.3.1
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: bittrance
+          password: ${{ secrets.DOCKER_SECRET }}
+      - name: Build and push container
+        uses: docker/build-push-action@v4
+        with:
+          push: true
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache
+          tags: bittrance/kitops:${{ steps.get_tag.outputs.tag }}
+          labels: |
+            org.opencontainers.image.title=${{ github.event.repository.name }}
+            org.opencontainers.image.description=${{ github.event.repository.description }}
+            org.opencontainers.image.url=${{ github.event.repository.html_url }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ steps.prep.outputs.VERSION }}
+            org.opencontainers.image.created=${{ steps.prep.outputs.BUILD_DATE }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..57e1f76
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,13 @@
+FROM rust:1.72-buster AS builder
+
+WORKDIR /app
+COPY Cargo.toml Cargo.lock ./
+COPY ./src/ ./src/
+RUN cargo install --path .
+
+FROM debian:buster-slim
+
+COPY --from=builder /app/target/release/kitops /usr/local/bin/kitops
+RUN apt-get update && apt-get install -y ca-certificates openssl && rm -rf /var/lib/apt/lists/*
+
+ENTRYPOINT ["/usr/local/bin/kitops"]
\ No newline at end of file
diff --git a/README.md b/README.md
index def8ef7..9918d0e 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ The plan forward, roughly in falling priority:
 - [x] specialized notification action to update github status
 - [x] new git sha and branch name in action env vars
 - [x] changed task config should override state loaded from disk
-- [ ] docker packaging
+- [x] docker packaging
 - [ ] readme with design and deployment options
 - [ ] intelligent gitconfig handling
 - [ ] allow git commands in workdir (but note that this means two tasks can no longer point to the same repo without additional changeas)