diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 94dc908..2c18e84 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,4 +97,75 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-target-${{ hashFiles('**/Cargo.lock') }}-
             ${{ runner.os }}-cargo-target-
-      - run: cargo test
\ No newline at end of file
+      - run: cargo test
+
+  build:
+    name: Build (${{ matrix.arch }})
+    needs: [test]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' # only build on main (for now)
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: mozilla-actions/sccache-action@v0.0.5
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          cache: false
+      - name: Cache Cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+          key: ${{ runner.os }}-${{ matrix.arch }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ matrix.arch }}-cargo-registry-
+      - name: Build release binary
+        run: cargo build --release --bin server
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push Docker image
+        run: |
+          docker build -t ghcr.io/${{ github.repository }}:${{ github.sha }}-${{ matrix.arch }} .
+          docker push ghcr.io/${{ github.repository }}:${{ github.sha }}-${{ matrix.arch }}
+
+  manifest:
+    name: Create multi-arch manifest
+    runs-on: ubuntu-latest
+    needs: [build]
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Create and push multi-arch manifest
+        run: |
+          docker manifest create ghcr.io/${{ github.repository }}:${{ github.sha }} \
+            ghcr.io/${{ github.repository }}:${{ github.sha }}-amd64 \
+            ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64
+          docker manifest push ghcr.io/${{ github.repository }}:${{ github.sha }}
+
+          docker manifest create ghcr.io/${{ github.repository }}:latest \
+            ghcr.io/${{ github.repository }}:${{ github.sha }}-amd64 \
+            ghcr.io/${{ github.repository }}:${{ github.sha }}-arm64
+          docker manifest push ghcr.io/${{ github.repository }}:latest
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..e9d3764
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,24 @@
+FROM ubuntu:24.04
+
+LABEL org.opencontainers.image.source="https://github.com/hotdata-dev/rivetdb"
+LABEL org.opencontainers.image.description="Federated query engine with on-demand caching. Run: docker run -p 3000:3000 ghcr.io/hotdata-dev/rivetdb | Custom config: docker run -p 3000:3000 -v ./config.toml:/app/config.toml ghcr.io/hotdata-dev/rivetdb"
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+
+WORKDIR /app
+
+# Install runtime dependencies
+RUN apt-get update && apt-get install -y \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy pre-built binary and default config
+COPY target/release/server ./server
+COPY config-docker.toml ./config.toml
+
+# Create directories for cache and state
+RUN mkdir -p ./cache ./state
+
+EXPOSE 3000
+
+ENTRYPOINT ["./server"]
+CMD ["config.toml"]
\ No newline at end of file
diff --git a/config-docker.toml b/config-docker.toml
new file mode 100644
index 0000000..cdfba2a
--- /dev/null
+++ b/config-docker.toml
@@ -0,0 +1,13 @@
+[server]
+host = "0.0.0.0"
+port = 3000
+
+[catalog]
+type = "duckdb"
+
+[storage]
+type = "filesystem"
+
+[paths]
+cache_dir = "/app/cache"
+state_dir = "/app/state"
\ No newline at end of file