diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..2d2c3db
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+target
+.git
+Dockerfile
+.dockerignore
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7f57bda
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,23 @@
+FROM rust:1.94-bookworm AS builder
+WORKDIR /build
+
+# Build dependencies against stub sources so this layer is only invalidated by Cargo.toml/Cargo.lock changes.
+COPY Cargo.toml Cargo.lock ./
+RUN mkdir -p src/bin \
+    && touch src/lib.rs \
+    && echo 'fn main() {}' > src/bin/rust-bfdd.rs \
+    && cargo build --release --locked --bin rust-bfdd \
+    && rm -rf src
+
+COPY src ./src
+# COPY keeps the host mtimes, which may predate the stub build; force cargo to rebuild the crate itself.
+RUN touch src/lib.rs src/bin/rust-bfdd.rs \
+    && cargo build --release --locked --bin rust-bfdd
+
+FROM debian:bookworm-slim
+RUN useradd --system --no-create-home --shell /usr/sbin/nologin bfd \
+    && mkdir -p /etc/rust-bfd/hooks.d
+COPY --from=builder /build/target/release/rust-bfdd /usr/local/bin/rust-bfdd
+USER bfd
+EXPOSE 3784/udp
+ENTRYPOINT ["/usr/local/bin/rust-bfdd"]