diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..3c7f02d
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,27 @@
+# Waf build system
+build/
+.waf-*-*/
+.waf3-*-*/
+.lock-waf*
+
+# Compiled python code
+**/__pycache__/
+**/*.py[cod]
+
+# Qt Creator
+*.creator
+*.creator.user
+.qtc_clangd/
+
+# Visual Studio Code
+.vscode/
+
+# macOS
+**/.DS_Store
+**/.AppleDouble
+**/.LSOverride
+**/._*
+
+# Other
+Dockerfile
+VERSION.info
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..dd71b5d
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,19 @@
+name: Docker
+on:
+  push:
+    tags:
+      - 'NLSR-*'
+  schedule:
+    # twice a month
+    - cron: '20 9 5,20 * *'
+  workflow_dispatch:
+
+permissions:
+  packages: write
+  id-token: write
+
+jobs:
+  nlsr:
+    uses: named-data/actions/.github/workflows/docker-image.yml@v1
+    with:
+      name: nlsr
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..9d9de95
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,66 @@
+# syntax=docker/dockerfile:1
+
+ARG NDN_CXX_VERSION=latest
+
+FROM scratch AS psync
+ARG PSYNC_VERSION=master
+ADD https://github.com/named-data/PSync.git#${PSYNC_VERSION} /
+
+FROM ghcr.io/named-data/ndn-cxx-build:${NDN_CXX_VERSION} AS build
+
+RUN apt-get install -Uy --no-install-recommends \
+        libboost-iostreams-dev \
+    && apt-get distclean
+
+ARG JOBS
+ARG SOURCE_DATE_EPOCH
+RUN --mount=from=psync,rw,target=/psync <<EOF
+    set -eux
+    cd /psync
+    ./waf configure \
+        --prefix=/usr \
+        --libdir=/usr/lib \
+        --sysconfdir=/etc \
+        --localstatedir=/var \
+        --sharedstatedir=/var
+    ./waf build
+    ./waf install
+EOF
+RUN --mount=rw,target=/src <<EOF
+    set -eux
+    cd /src
+    ./waf configure \
+        --prefix=/usr \
+        --libdir=/usr/lib \
+        --sysconfdir=/etc \
+        --localstatedir=/var \
+        --sharedstatedir=/var \
+        --with-psync
+    ./waf build
+    ./waf install
+    mkdir -p /deps/debian
+    touch /deps/debian/control
+    cd /deps
+    dpkg-shlibdeps --ignore-missing-info /usr/lib/libPSync.so.* /usr/bin/nlsr /usr/bin/nlsrc -O \
+        | sed -n 's|^shlibs:Depends=||p' | sed 's| ([^)]*),\?||g' > nlsr
+EOF
+
+
+FROM ghcr.io/named-data/ndn-cxx-runtime:${NDN_CXX_VERSION} AS nlsr
+
+COPY --link --from=build /usr/lib/libPSync.so.* /usr/lib/
+COPY --link --from=build /usr/bin/nlsr /usr/bin/
+COPY --link --from=build /usr/bin/nlsrc /usr/bin/
+COPY --link --from=build /etc/ndn/nlsr.conf.sample /config/nlsr.conf
+
+RUN --mount=from=build,source=/deps,target=/deps \
+    apt-get install -Uy --no-install-recommends $(cat /deps/nlsr) \
+    && apt-get distclean
+
+ENV HOME=/config
+VOLUME /config
+VOLUME /var/lib/nlsr
+VOLUME /run/nfd
+
+ENTRYPOINT ["/usr/bin/nlsr"]
+CMD ["-f", "/config/nlsr.conf"]