diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..b9e8b67
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+# Look for updates to python and docker dependencies.
+
+version: 2
+updates:
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "daily"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..a9ba7aa
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,90 @@
+name: Build and publish image to ghcr.io/epics-containers
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build:
+    # pull requests are a duplicate of a branch push if within the same repo.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        epics-target: [linux-x86_64] # , linux-aarch64]
+        include:
+          - os: ubuntu-latest # everyone is on ubuntu-latest
+          - epics-target: linux-x86_64
+            platform: linux/amd64
+
+          # # a temporary name until multi-arch is supported
+          # - epics-target: linux-aarch64
+          #     extension: -native-aarch64
+          #     platform: linux/arm64
+
+    runs-on: ${{ matrix.os }}
+    env:
+      TAG: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}
+    steps:
+
+      - name: Log in to GitHub Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io/${{ github.repository_owner }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          target: final
+          cache-from: type=gha,scope=${{ matrix.epics-target }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.epics-target }}
+          tags: ci_test
+          load: true
+
+      - name: Test image
+        # Opportunity to run tests using docker run 'ci_test'
+        if: ${{ matrix.epics-target == 'linux-x86_64' }}
+        run: if [ -f tests/run-tests.sh ]; then tests/run-tests.sh ci_test; fi
+
+      - name: Push final image
+        if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
+        uses: docker/build-push-action@v6
+        with:
+          platforms: ${{ matrix.platform }}
+          target: final
+          tags: ${{ env.TAG }}:${{ github.ref_name }}
+          push: true
+
+      - name: Push debug image
+        if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
+        uses: docker/build-push-action@v6
+        with:
+          platforms: ${{ matrix.platform }}
+          target: dockerizer
+          tags: ${{ env.TAG }}-debug:${{ github.ref_name }}
+          push: true
+
+  release:
+    # Release on tag push
+    needs: [build]
+    if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Github Release
+        uses: softprops/action-gh-release@c062e08 # v2.0.8
+        with:
+          generate_release_notes: true
diff --git a/Dockerfile b/Dockerfile
index 9ce0316..1e17322 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -46,6 +46,7 @@ RUN dockerize -L preserve -n -u scs -o /ca-gateway_root --verbose /epics/gateway
  # /epics is owned by scs in this image and should also be in later one:
  && chown -R scs:users /ca-gateway_root/epics
 
+ENTRYPOINT ["/epics/gateway"]
 
 ## =========================================
 #  4th stage: Finally put together our image