diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
new file mode 100644
index 0000000..32aba26
--- /dev/null
+++ b/.github/workflows/create-release.yml
@@ -0,0 +1,65 @@
+name: "Create release"
+
+on:
+  push:
+    tags:
+      - "**"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash -l -e -o pipefail {0}
+    env:
+      IMAGE_NAME: bambi
+      REPOSITORY_OWNER: ${{ github.repository_owner }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: "Fetch Tags"
+        # Workaround for https://github.com/actions/checkout/issues/290
+        run: git fetch --tags --force
+
+      - name: "Get release variables"
+        # RELEASE_VERSION assignment must match the command used in autoconf's
+        # configure.ac file. On update, care should be taken to maintain both
+        # sides congruent.
+        run: |
+          echo 'RELEASE_VERSION='$(git describe --always --tags --dirty) >> $GITHUB_ENV
+          echo 'GIT_URL='$(git remote get-url origin) >> $GITHUB_ENV
+          echo 'GIT_COMMIT='$(git log --pretty=format:'%H' -n 1) >> $GITHUB_ENV
+
+      - name: "Login to Docker registry"
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Build Docker image"
+        run: |
+          set -x
+          docker build --rm \
+            --file docker/Dockerfile \
+            --build-arg HTSLIB_BRANCH=1.18 \
+            --platform linux/amd64 \
+            --progress plain \
+            --load \
+            --label "org.opencontainers.image.title=bambi" \
+            --label "org.opencontainers.image.source=${GIT_URL}" \
+            --label "org.opencontainers.image.revision=${GIT_COMMIT}" \
+            --label "org.opencontainers.image.version=${RELEASE_VERSION}" \
+            --label "org.opencontainers.image.created=$(date --utc --iso-8601=seconds)" \
+            --tag "ghcr.io/$REPOSITORY_OWNER/${IMAGE_NAME}:${RELEASE_VERSION}" \
+            --tag "ghcr.io/$REPOSITORY_OWNER/${IMAGE_NAME}:latest" \
+            .
+
+      - name: "Push image to registry"
+        run: |
+            docker push "ghcr.io/$REPOSITORY_OWNER/$IMAGE_NAME:$RELEASE_VERSION"
+            docker push "ghcr.io/$REPOSITORY_OWNER/$IMAGE_NAME:latest"
diff --git a/.github/workflows/lint-and-test-build-dockerfile.yml b/.github/workflows/lint-and-test-build-dockerfile.yml
new file mode 100644
index 0000000..0760d27
--- /dev/null
+++ b/.github/workflows/lint-and-test-build-dockerfile.yml
@@ -0,0 +1,52 @@
+name: "Lint and test-build Dockerfile"
+
+on:
+  push:
+    branches:
+      - '**'
+
+jobs:
+  lint-docker:
+    runs-on: ubuntu-latest
+
+    continue-on-error: true
+
+    defaults:
+      run:
+        shell: "bash -l -e -o pipefail {0}"
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: "Lint Dockerfile"
+        run: |
+          cat <<EOT >> .hadolint.yaml
+          ignored:
+            - DL3008
+          EOT
+          docker run --rm -i -v /"${PWD}"/.hadolint.yaml:/.config/hadolint.yaml ghcr.io/hadolint/hadolint < docker/Dockerfile
+
+  build-docker:
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        shell: "bash -l -e -o pipefail {0}"
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: "Docker build"
+        run: |
+          set -x
+          docker build --rm \
+            --file docker/Dockerfile \
+            --build-arg HTSLIB_BRANCH=1.18 \
+            --tag bambi .
+          docker run bambi bambi --version
diff --git a/ChangeLog b/ChangeLog
index 450b0b2..e91d445 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+  [0.17.1]
+  Add docker tooling and image publishing
+
   [0.17.0]
   Change the --nocall-quality option from an integer to boolean, and ensure it applies to QT tags.
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
new file mode 100644
index 0000000..c0aaf7e
--- /dev/null
+++ b/docker/Dockerfile
@@ -0,0 +1,84 @@
+FROM debian:bookworm AS htslib_build
+
+ARG HTSLIB_BRANCH
+
+# hadolint ignore=DL3003
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
+    apt-get install -qq -y --no-install-recommends \
+      autoconf \
+      automake \
+      autotools-dev \
+      build-essential \
+      ca-certificates \
+      git \
+      libbz2-dev \
+      libcurl4-openssl-dev \
+      libgd-dev \
+      liblzma-dev \
+      libssl-dev \
+    && \
+    export HTSLIB=/usr/local/src/htslib && \
+    git clone --depth 1 --branch "${HTSLIB_BRANCH}" https://github.com/samtools/htslib.git "${HTSLIB}" && \
+    cd "${HTSLIB}" && \
+    git submodule update --init --recursive && \
+    mkdir -p /tmp/usr/local && \
+    autoreconf -i && \
+    ./configure --prefix=/tmp/usr/local && \
+    make && \
+    make install
+
+FROM debian:bookworm AS bambi_build
+
+COPY --from=htslib_build /tmp/usr/local /usr/local
+COPY . /usr/local/src/bambi
+
+WORKDIR /usr/local/src/bambi
+
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
+    apt-get install -qq -y --no-install-recommends \
+      autoconf \
+      automake \
+      autotools-dev \
+      build-essential \
+      bzip2 \
+      git \
+      libbz2-dev \
+      libcurl4-openssl-dev \
+      libtool \
+      libgd-dev \
+      liblzma-dev \
+      libxml2-dev \
+      libz-dev \
+      libssl-dev \
+    && \
+    export PREFIX=/tmp/usr/local && \
+    autoreconf -fi && \
+    CPPFLAGS="-I$PREFIX/include" LDFLAGS="-Wl,-rpath,$PREFIX/lib -L$PREFIX/lib" \
+            ./configure --prefix="$PREFIX" --with-htslib="$PREFIX" && \
+    make CPPFLAGS="-I$PREFIX/include" LDFLAGS="-L$PREFIX/lib" && \
+    make install prefix="$PREFIX"
+
+FROM debian:bookworm AS bambi
+
+COPY --from=htslib_build /tmp/usr/local /usr/local
+COPY --from=bambi_build /tmp/usr/local /usr/local
+
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \
+    apt-get install -qq -y --no-install-recommends \
+      libbz2-1.0 \
+      libcurl4 \
+      libgd3 \
+      liblzma5 \
+      libxml2 \
+      libz1 \
+      libssl3 \
+    && \
+    apt-get remove -q -y unattended-upgrades && \
+    apt-get autoremove -q -y && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+CMD ["/bin/bash"]