diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
new file mode 100644
index 0000000..95893ed
--- /dev/null
+++ b/.github/workflows/docker-publish.yml
@@ -0,0 +1,75 @@
+name: Docker
+
+on:
+  push:
+    branches:
+      - main     # 当 `main` 分支有 push 时触发
+    tags:
+      - 'v*.*.*'  # 当有新的 tag 时触发
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@v3.5.0
+        with:
+          cosign-release: 'v2.2.4'
+
+      # 设置 Buildx 以支持多架构构建
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # 登录 GitHub Container Registry
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # 提取 Docker 镜像的元数据（标签、名称等）
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=ref,event=branch
+            type=sha
+            type=ref,event=tag
+
+      # 构建并推送多架构 Docker 镜像
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6.9.0 
+        id: build-and-push
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # 使用 cosign 签名发布的 Docker 镜像
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          images=""
+          for tag in $(echo $TAGS | tr ',' '\n'); do
+            images+="ghcr.io/${{ github.repository }}:$tag@${DIGEST} "
+          done
+          cosign sign --yes ${images}
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..dde5e7a
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,11 @@
+version: '3.8'
+
+services:
+  weibo-album-dl:
+    image: weibo-album-dl:latest
+    container_name: weibo-album-dl
+    restart: unless-stopped
+    volumes:
+      - ./dl:/dl  # 可选：挂载本地目录到容器中
+    environment:
+      WB_DL_ARGS: "-s /dl"
\ No newline at end of file
diff --git a/src/main.scala b/src/main.scala
index 18877d9..2e291c7 100644
--- a/src/main.scala
+++ b/src/main.scala
@@ -27,27 +27,34 @@ def run(p: String) =
     )
   log.info("finished term")
 
+def logHelp(args: Seq[String]) = log.info(s"""
+  unsupported args: ${args.mkString(" ")}!
+  try these blow:
+    -w `path` to walk through uids inside `path`
+    -s `path` to walk through uids inside `path` periodically (once a day)
+    -u `uid`  to download all images of `uid`
+  """)
+
 @main
 def main(args: String*): Unit =
   args match
-    case "-w" :: dir :: _ => run(dir)
-    case "-s" :: dir :: _ =>
+    case _ if args.size == 0 =>
+      val argsStr = System.getenv("WB_DL_ARGS")
+      argsStr match
+        case _ if argsStr != null && argsStr.length() != 0 =>
+          val argsFromEnv = argsStr.split(" ")
+          wrappedMain(argsFromEnv*)
+        case _ => logHelp(Seq("empty char"))
+    case _ => wrappedMain(args*)
+
+def wrappedMain(args: String*): Unit =
+  args match
+    case Seq("-w", dir) => run(dir)
+    case Seq("-s", dir) =>
       scheduler.scheduleWithFixedDelay(() => run(dir), 0, 1, TimeUnit.DAYS)
-    case "-u" :: uid :: dir :: _ =>
+    case Seq("-u", uid, dir) =>
       val p = util.path(dir)
       if !os.exists(p) then throw FileNotFoundException(s"$p does not exists")
       val cookies = sinaVisitorSystem
       getAlbum(uid, p, cookies)
-    case _ =>
-      val argsStr = System.getenv("WB_DL_ARGS")
-
-      if argsStr != null && argsStr.length() != 0 then
-        val args = argsStr.split(" ").toSeq
-        main(args*)
-      else log.info(s"""
-          unsupported args ${args.mkString(" ")}!
-          try these blow:
-            -w `path` to walk through uids inside `path`
-            -s `path` to walk through uids inside `path` periodically (once a day)
-            -u `uid`  to download all images of `uid`
-          """)
+    case _ => logHelp(args)
diff --git a/weibo-album-dl.container b/weibo-album-dl.container
new file mode 100644
index 0000000..1225bb9
--- /dev/null
+++ b/weibo-album-dl.container
@@ -0,0 +1,16 @@
+[Container]
+ContainerName=weibo-album-dl
+Environment="WB_DL_ARGS=-s /dl"
+Image=weibo-album-dl:latest
+Volume=/mnt/sda1/code/dl:/dl
+WorkingDir=/app
+
+[Service]
+Restart=always
+
+[Unit]
+Description=weibo-album-dl
+After=network.target
+
+[Install]
+WantedBy=multi-user.target