diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
new file mode 100644
index 00000000..3cb2d1e2
--- /dev/null
+++ b/.github/workflows/docker-build.yaml
@@ -0,0 +1,59 @@
+name: Docker Build
+
+on:
+  push:
+    branches:
+      - "master"
+    tags:
+      - "*"
+  pull_request:
+
+env:
+  build_platforms: ${{ env.BUILD_PLATFORMS || 'linux/amd64,linux/arm64/v8' }}
+  build_image: ${{ env.BUILD_IMAGE || 'ghcr.io/isso-comments/isso' }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          flavor: |
+            latest=false
+          images: ${{ env.build_image }}
+          tags: |
+            type=ref,event=pr
+            type=semver,pattern={{major}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{version}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Login to Github Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@v4
+        with:
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: ${{ env.build_platforms }}
+
+      - name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
diff --git a/Dockerfile b/Dockerfile
index 903f6950..a85c4407 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,34 +23,26 @@ COPY ["isso/js/", "./isso/js/"]
 # Run webpack to generate minified Javascript
 RUN make js
 
-# Second stage: Create production-ready Isso package
+# Second stage: Install Python dependencies and Isso app
 
 # Copy needed files
 FROM python:3.10-alpine AS isso-builder
-WORKDIR /isso/
-
-# Set up virtualenv
-RUN python3 -m venv /isso \
- && . /isso/bin/activate \
- && pip3 install --no-cache-dir --upgrade pip \
- && pip3 install --no-cache-dir gunicorn
 
 # Install cffi dependencies since they're not present on alpine by default
 # (required by cffi which in turn is required by misaka)
 RUN apk add --no-cache gcc libffi-dev libc-dev
 
-# For some reason, it is required to install cffi before misaka, else pip will
-# fail to build cffi
-RUN . /isso/bin/activate \
- && pip3 install cffi
+WORKDIR /isso/
+COPY ["setup.py", "setup.cfg", "README.md", "LICENSE", "./"]
 
-# Install Isso's python dependencies via pip in a separate step before copying
+# Set up virtualenv, and install dependencies in a separate step before copying
 # over client files, so that changing Isso js/python source code will not
-# trigger a re-installation of all pip packages from scratch
-COPY ["setup.py", "setup.cfg", "README.md", "LICENSE", "./"]
+# trigger a re-installation of all pip packages from scratch.
 RUN --mount=type=cache,target=/root/.cache \
-  . /isso/bin/activate \
- && python3 setup.py develop
+  python3 -m venv /isso \
+  && . /isso/bin/activate \
+  && pip install --upgrade pip gunicorn \
+  && python3 setup.py develop
 
 # Then copy over files
 # SRC "isso/" is treated as "isso/*" by docker, so copy to subdir explicitly
@@ -65,8 +57,7 @@ RUN --mount=type=cache,target=/root/.cache \
  . /isso/bin/activate \
  && python3 setup.py develop --no-deps
 
-
-# Third stage: Run Isso
+# Third stage: Create production-ready image
 FROM python:3.10-alpine AS isso
 WORKDIR /isso/
 COPY --from=isso-builder /isso/ .