diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a1cdb4d3..74fcec4e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,10 +21,18 @@ on:
 permissions:
   contents: write
 
+env:
+  IMAGE: ghcr.io/upsun/cli
+
 jobs:
   release:
     runs-on: ubuntu-latest
     environment: production
+    permissions:
+      contents: write
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+      is_prerelease: ${{ steps.tag.outputs.is_prerelease }}
 
     steps:
       - name: Resolve tag
@@ -163,3 +171,70 @@ jobs:
         if: always()
         run: |
           rm -rf "${{ steps.signing-keys.outputs.key_dir }}"
+
+  docker:
+    runs-on: ${{ matrix.runner }}
+    needs: release
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            platform: linux/amd64
+            suffix: amd64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64
+            suffix: arm64
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: https://github.com/${{ github.repository }}.git#${{ needs.release.outputs.tag }}
+          platforms: ${{ matrix.platform }}
+          push: true
+          tags: ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-${{ matrix.suffix }}
+          build-args: |
+            VERSION=${{ needs.release.outputs.tag }}
+          cache-from: type=gha,scope=${{ matrix.suffix }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.suffix }}
+
+  docker-manifest:
+    runs-on: ubuntu-latest
+    needs: [docker, release]
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create and push versioned manifest
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.IMAGE }}:${{ needs.release.outputs.tag }} \
+            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-amd64 \
+            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-arm64
+
+      - name: Create and push latest manifest
+        if: needs.release.outputs.is_prerelease == 'false'
+        run: |
+          docker buildx imagetools create \
+            --tag ${{ env.IMAGE }}:latest \
+            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-amd64 \
+            ${{ env.IMAGE }}:${{ needs.release.outputs.tag }}-arm64
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..ad1a3e9a
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,10 @@
+FROM alpine:3
+
+RUN apk add --no-cache ca-certificates curl git openssh-client
+
+ARG VERSION=
+RUN [ -n "$VERSION" ] || { echo "VERSION is required" >&2; exit 1; }
+COPY installer.sh /tmp/installer.sh
+RUN INSTALL_METHOD=raw VERSION=$VERSION sh /tmp/installer.sh && rm /tmp/installer.sh
+
+ENTRYPOINT ["upsun"]
\ No newline at end of file
diff --git a/README.md b/README.md
index 77be0ee1..ad96f8c2 100644
--- a/README.md
+++ b/README.md
@@ -112,6 +112,14 @@ sudo dnf install -y upsun-cli
 
 For manual installation, you can also [download the latest binaries](https://github.com/upsun/cli/releases/latest).
 
+### Docker
+
+The CLI is also available as a Docker image:
+
+```console
+docker run --rm -it ghcr.io/upsun/cli
+```
+
 ## Upgrade
 
 Upgrade using the same tool:
@@ -188,6 +196,7 @@ Releases are automated via GitHub Actions. To create a new release:
    - Sign packages (APK, DEB, RPM)
    - Create a GitHub release with all artifacts
    - Update package repositories at repositories.upsun.com
+   - Build and push Docker image to ghcr.io/upsun/cli
 
 ## Licenses