diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 00000000..d11a6aed
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,50 @@
+name: Publish Docker image
+
+on:
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - '*.md'
+      - '.mailmap'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Login to ${{ env.REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: latest=true
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          pull: true
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..1d0515a7
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,38 @@
+FROM ghcr.io/named-data/ndn-cxx:latest as builder
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends libpcap-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY . /NFD
+
+RUN cd /NFD \
+    && ./waf configure --without-pch --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
+    && ./waf \
+    && ./waf install \
+    # get list of dependencies
+    && mkdir -p /shlibdeps/debian && cd /shlibdeps && touch debian/control \
+    && dpkg-shlibdeps --ignore-missing-info /usr/lib/libndn-cxx.so* /usr/bin/nfdc /usr/bin/nfd \
+    && sed -n '/^shlibs:Depends=/ s|shlibs:Depends=||p' debian/substvars | sed -e 's|,||g' -e 's| ([^)]*)||g' > /deps.txt
+
+# use same base distro version as named-data/ndn-cxx
+FROM debian:bookworm
+
+COPY --from=builder /deps.txt /
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends $(cat /deps.txt) \
+    && rm -rf /var/lib/apt/lists/* /deps.txt
+
+COPY --from=builder /usr/lib/libndn-cxx.so* /usr/lib/
+COPY --from=builder /usr/bin/nfd /usr/bin/
+COPY --from=builder /usr/bin/nfdc /usr/bin/
+
+VOLUME /config
+VOLUME /run/nfd
+
+EXPOSE 6363/tcp
+EXPOSE 6363/udp
+EXPOSE 9696/tcp
+
+ENTRYPOINT ["/usr/bin/nfd"]
+CMD ["--config", "/config/nfd.conf"]