diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..39f1e15
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,67 @@
+name: build
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+on:
+  workflow_dispatch:
+    inputs:
+      image_push:
+        type: boolean
+        description: 'Push images to Container Registry'
+        required: false
+        default: false
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  push:
+    branches:
+      - main
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        from:
+          - jammy
+        release:
+          - "2023.1"
+    steps:
+      - name: Install QEMU static binaries
+        uses: docker/setup-qemu-action@v2
+      - name: Configure Buildkit
+        uses: docker/setup-buildx-action@v2
+      - name: Checkout project
+        uses: actions/checkout@v3
+      - name: Setup environment variables
+        run: echo "PROJECT_REF=${{ github.sha }}" >> "$GITHUB_ENV"
+      - name: Authenticate with Quay.io
+        uses: docker/login-action@v2
+        if: ${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.image_push == true) }}
+        with:
+          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+      - name: Build image
+        uses: docker/build-push-action@v3
+        with:
+          build-args: |-
+            BUILDER_IMAGE=quay.io/vexxhost/openstack-builder-${{ matrix.from }}
+            RUNTIME_IMAGE=quay.io/vexxhost/openstack-runtime-${{ matrix.from }}
+            RELEASE=${{ matrix.release }}
+            PROJECT=staffln
+            PROJECT_REPO=https://github.com/vexxhost/staffeln
+            PROJECT_REF=${{ env.PROJECT_REF }}
+          cache-from: type=gha,scope=${{ matrix.from }}-${{ matrix.release }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.from }}-${{ matrix.release }}
+          context: .
+          platforms: linux/amd64
+          push: ${{ github.event_name == 'push' || inputs.image_push == true }}
+          tags: quay.io/vexxhost/staffeln:${{ env.PROJECT_REF }}-${{ matrix.from }}
+      - name: Promote image
+        uses: akhilerm/tag-push-action@v2.0.0
+        if: github.event_name == 'push' && ((matrix.from == 'focal') || (matrix.from == 'jammy' && matrix.release != 'yoga'))
+        with:
+          dst: quay.io/vexxhost/staffeln:${{ matrix.release }}
+          src: quay.io/vexxhost/staffeln:${{ env.PROJECT_REF }}-${{ matrix.from }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b21c967
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+# syntax=docker/dockerfile-upstream:master-labs
+
+ARG BUILDER_IMAGE=quay.io/vexxhost/openstack-builder-focal
+ARG RUNTIME_IMAGE=quay.io/vexxhost/openstack-runtime-focal
+
+# hadolint ignore=DL3007
+FROM quay.io/vexxhost/bindep-loci:latest AS bindep
+
+FROM ${BUILDER_IMAGE}:ced4522d9a10ba7172f373289af6dace06be3b36 AS builder
+COPY --from=bindep --link /runtime-pip-packages /runtime-pip-packages
+
+FROM ${RUNTIME_IMAGE}:a391e31bb33041611e2aa2797debcb21e6f221cd AS runtime
+COPY --from=bindep --link /runtime-dist-packages /runtime-dist-packages
+COPY --from=builder --link /var/lib/openstack /var/lib/openstack
+# hadolint ignore=DL3022
+COPY --from=docker.io/alpine/helm:3.11.2 /usr/bin/helm /usr/local/bin/helm
+# hadolint ignore=DL3022
+COPY --from=gcr.io/go-containerregistry/crane /ko-app/crane /usr/local/bin/crane