diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000000..be3835d62c
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,67 @@
+name: docker
+
+on:
+  push:
+    tags: ["v*"]
+    branches: ['docker-release']
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker:
+    name: docker-${{ matrix.flavor }}
+    strategy:
+      fail-fast: false
+      matrix:
+        flavor:
+          - alpine
+          - deb
+          - github-actions
+          - rpm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/jdx/rtx:${{ matrix.flavor }}
+          labels: ${{ steps.meta.outputs.labels }}
+          file: packaging/${{ matrix.flavor }}/Dockerfile
+  test:
+    runs-on: ubuntu-22.04
+    container: ghcr.io/jdx/rtx:github-actions
+    timeout-minutes: 10
+    steps:
+      - run: node -v
+      - run: cargo -V
+      - name: Checkout
+        uses: actions/checkout@v4
+#      - name: Rust Cache
+#        uses: Swatinem/rust-cache@v2
+#        with:
+#          save-if: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+      - name: Run cargo nextest
+        run: cargo nextest run --all-features
+        env:
+          RUST_BACKTRACE: "1"
diff --git a/.github/workflows/rtx.yml b/.github/workflows/rtx.yml
index 0f22f02a14..7907fcd306 100644
--- a/.github/workflows/rtx.yml
+++ b/.github/workflows/rtx.yml
@@ -168,7 +168,7 @@ jobs:
     runs-on: ubuntu-22.04
     needs: [build-linux]
     timeout-minutes: 10
-    container: jdxcode/rtx:rpm
+    container: ghcr.io/jdx/rtx:rpm
     if: github.event_name != 'pull_request'
     steps:
       - uses: actions/checkout@v4
@@ -191,7 +191,7 @@ jobs:
           if-no-files-found: error
   deb:
     runs-on: ubuntu-22.04
-    container: jdxcode/rtx:deb
+    container: ghcr.io/jdx/rtx:deb
     timeout-minutes: 10
     if: github.event_name != 'pull_request'
     needs: [build-linux]
@@ -305,7 +305,7 @@ jobs:
           formula: rtx
   bump-alpine:
     runs-on: ubuntu-22.04
-    container: jdxcode/rtx:alpine
+    container: ghcr.io/jdx/rtx:alpine
     timeout-minutes: 30
     needs: [release]
     steps:
diff --git a/packaging/github-actions/Dockerfile b/packaging/github-actions/Dockerfile
new file mode 100644
index 0000000000..62df761fbf
--- /dev/null
+++ b/packaging/github-actions/Dockerfile
@@ -0,0 +1,49 @@
+FROM ubuntu
+LABEL maintainer="jdx"
+
+ENV PATH="/root/.cargo/bin:${PATH}"
+ENV CARGO_HOME="/root/.cargo"
+
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y \
+        bash \
+        build-essential \
+        ca-certificates \
+        curl \
+        direnv \
+        fish \
+        fd-find \
+        git \
+        gnupg \
+        libssl-dev \
+        pkg-config \
+        shellcheck \
+        shfmt \
+        sudo \
+    && ln -s /usr/bin/{fdfind,fd} \
+    && mkdir -p /etc/apt/keyrings \
+    && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
+    && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list \
+    && apt-get update && apt-get install -y nodejs \
+    && node -v \
+    && npm i -g markdown-magic \
+    && curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/bin \
+    && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
+    && curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash \
+    && rustup install stable && rustup default stable \
+    && rustup toolchain install nightly --component llvm-tools-preview \
+    && cargo binstall -y \
+        cargo-deny \
+        cargo-llvm-cov \
+        cargo-machete \
+        cargo-msrv \
+        cross \
+        nextest \
+        zipsign \
+    && apt-get clean \
+    && rustc -vV \
+    && cargo -V \
+    && node -v \
+    && npm -v \
+    && just --version