diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..adeb9419
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,10 @@
+# Ignore everything and use an allowlist of what is allowed to not package any secrets by accident.
+*
+
+# Allow files and directories.
+!cmd/
+!internal/
+!go.*
+
+# Ignore unnecessary files inside allowed directories.
+**/.DS_Store
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..62d9e11d
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,14 @@
+FROM golang:1.23.2-alpine AS uncloudd
+
+ARG TARGETOS
+ARG TARGETARCH
+
+COPY . .
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main.go
+
+
+FROM docker:27.3.1-dind
+RUN apk --no-cache add \
+    wireguard-tools
+COPY --from=uncloudd /go/uncloudd /usr/local/bin/uncloudd
+CMD ["uncloudd"]