diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..9abc787
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+.git
+.gitea
+.env
+*.log
diff --git a/.gitea/workflows/publish-image.yml b/.gitea/workflows/publish-image.yml
new file mode 100644
index 0000000..4b77012
--- /dev/null
+++ b/.gitea/workflows/publish-image.yml
@@ -0,0 +1,79 @@
+name: Publish Docker Image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  docker:
+    runs-on: docker
+    container:
+      image: docker:27-git
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Build image metadata
+        id: meta
+        shell: sh
+        run: |
+          SERVER_URL="${GITHUB_SERVER_URL:-${GITEA_SERVER_URL:-}}"
+          if [ -z "$SERVER_URL" ]; then
+            echo "Neither GITHUB_SERVER_URL nor GITEA_SERVER_URL is set."
+            exit 1
+          fi
+
+          REGISTRY_HOST="${SERVER_URL#http://}"
+          REGISTRY_HOST="${REGISTRY_HOST#https://}"
+          IMAGE_REPO="$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')"
+
+          echo "registry_host=$REGISTRY_HOST" >> "$GITHUB_OUTPUT"
+          echo "image=$REGISTRY_HOST/$IMAGE_REPO" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to Gitea Container Registry
+        shell: sh
+        run: |
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login "${{ steps.meta.outputs.registry_host }}" -u "${{ github.actor }}" --password-stdin
+
+      - name: Build and push image
+        shell: sh
+        run: |
+          IMAGE="${{ steps.meta.outputs.image }}"
+          SHA_TAG="${GITHUB_SHA}"
+          REF_TYPE="${GITHUB_REF_TYPE}"
+          REF_NAME="${GITHUB_REF_NAME}"
+
+          TAG_ARGS="-t $IMAGE:$SHA_TAG"
+          PUSH_TAGS="$SHA_TAG"
+
+          # latest only for pushes to main
+          if [ "$REF_TYPE" = "branch" ] && [ "$REF_NAME" = "main" ]; then
+            TAG_ARGS="$TAG_ARGS -t $IMAGE:latest"
+            PUSH_TAGS="$PUSH_TAGS latest"
+          fi
+
+          # semver tags for refs like v1.2.3 -> v1.2.3, v1.2, v1
+          if [ "$REF_TYPE" = "tag" ]; then
+            case "$REF_NAME" in
+              v[0-9]*.[0-9]*.[0-9]*)
+                MAJOR="$(echo "$REF_NAME" | cut -d. -f1)"
+                MINOR="$(echo "$REF_NAME" | cut -d. -f2)"
+                TAG_ARGS="$TAG_ARGS -t $IMAGE:$REF_NAME -t $IMAGE:$MAJOR.$MINOR -t $IMAGE:$MAJOR"
+                PUSH_TAGS="$PUSH_TAGS $REF_NAME $MAJOR.$MINOR $MAJOR"
+                ;;
+              *)
+                TAG_ARGS="$TAG_ARGS -t $IMAGE:$REF_NAME"
+                PUSH_TAGS="$PUSH_TAGS $REF_NAME"
+                ;;
+            esac
+          fi
+
+          docker build $TAG_ARGS .
+
+          for TAG in $PUSH_TAGS; do
+            docker push "$IMAGE:$TAG"
+          done
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..18b3c02
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,16 @@
+FROM golang:1.23-alpine AS builder
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o /out/discord-thread-bot .
+
+FROM gcr.io/distroless/static-debian12:nonroot
+
+WORKDIR /app
+COPY --from=builder /out/discord-thread-bot /app/discord-thread-bot
+
+ENTRYPOINT ["/app/discord-thread-bot"]