diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..4829de7
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+.git
+.gitea
+.github
+books/
+users.db
+*.db
+dist/
+bin/
+.vscode
+.idea
+README.md
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
new file mode 100644
index 0000000..2816f13
--- /dev/null
+++ b/.github/workflows/docker-build.yml
@@ -0,0 +1,51 @@
+name: Docker Image bauen und veröffentlichen
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch: {}
+
+env:
+  REGISTRY: git.arnef.de
+  IMAGE_NAME: arnef/ebooks
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Repository auschecken
+        uses: actions/checkout@v4
+
+      - name: QEMU einrichten (für Cross-Platform-Builds)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Docker Buildx einrichten
+        uses: docker/setup-buildx-action@v3
+
+      - name: Bei Registry anmelden
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Metadaten (Tags/Labels) ermitteln
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix=,format=short
+
+      - name: Image bauen und pushen (amd64 + arm64)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..eded12f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,41 @@
+# syntax=docker/dockerfile:1
+
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS build
+WORKDIR /src
+
+ARG TARGETOS
+ARG TARGETARCH
+
+RUN apk add --no-cache git
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+# views/pages_templ.go ist bereits generiert und im Repo eingecheckt,
+# daher kein "templ generate" im Build notwendig.
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+    go build -trimpath -ldflags="-s -w" -o /out/server ./cmd/server
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+    go build -trimpath -ldflags="-s -w" -o /out/admin ./cmd/admin
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates tzdata && \
+    addgroup -S ebooks && adduser -S ebooks -G ebooks
+
+WORKDIR /app
+COPY --from=build /out/server /app/server
+COPY --from=build /out/admin /app/admin
+COPY static ./static
+
+ENV ADDR=:8080
+ENV BOOKS_DIR=/data/books
+ENV USERS_DB=/data/users.db
+
+RUN mkdir -p /data/books && chown -R ebooks:ebooks /data /app
+VOLUME ["/data"]
+USER ebooks
+
+EXPOSE 8080
+ENTRYPOINT ["/app/server"]