diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
new file mode 100644
index 0000000..7a2e222
--- /dev/null
+++ b/.github/workflows/docker-image.yml
@@ -0,0 +1,36 @@
+name: Build and publish backup image
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  workflow_dispatch:
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: |
+            openproject/backup:latest
+            openproject/backup:${{ github.sha }}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..1c17476
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,6 @@
+FROM kopia/kopia:latest AS kopia
+FROM rclone/rclone:latest AS rclone
+FROM postgres:17
+
+COPY --from=kopia /usr/bin/kopia /usr/local/bin/kopia
+COPY --from=rclone /usr/local/bin/rclone /usr/local/bin/rclone
diff --git a/README.md b/README.md
index f21cca3..e09d8b0 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,10 @@
 # backup
-A docker image containing tools for backing up OpenProject (kopia, rclone, pg_dump)
+A docker image containing tools for backing up OpenProject (kopia, rclone, pg_dump).
+
+The `Dockerfile` builds an image with:
+- latest `kopia`
+- latest `rclone`
+- PostgreSQL client tooling from `postgres:17` (`pg_dump` v17)
+
+A GitHub Actions workflow at `.github/workflows/docker-image.yml`
+builds and pushes `openproject/backup:latest` to Docker Hub.