diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..e0ad30c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+target
+docker
diff --git a/docker/aquatic_ws.Dockerfile b/docker/aquatic_ws.Dockerfile
new file mode 100644
index 0000000..5d122c1
--- /dev/null
+++ b/docker/aquatic_ws.Dockerfile
@@ -0,0 +1,32 @@
+# aquatic_ws
+#
+# If no changes are made to settings, aquatic_ws is run without
+# TLS, on port 3000 and with http health checks enabled.
+#
+# $ docker build -t aquatic-ws -f docker/aquatic_ws.Dockerfile .
+# $ docker run -it --rm --ulimit memlock=65536:65536 -p 3000:3000 --name aquatic-ws aquatic-ws
+
+FROM rust:latest AS builder
+
+WORKDIR /usr/src/aquatic
+
+COPY . .
+
+RUN . ./scripts/env-native-cpu-without-avx-512 && cargo build --release -p aquatic_ws
+
+FROM debian:stable-slim
+
+ENV CONFIG_FILE_CONTENTS "log_level = 'trace'\n\n[network]\nenable_http_health_checks = true"
+ENV ACCESS_LIST_CONTENTS ""
+
+WORKDIR /root/
+
+COPY --from=builder /usr/src/aquatic/target/release/aquatic_ws ./
+
+RUN echo "$CONFIG_FILE_CONTENTS" > ./config.toml
+RUN echo "$ACCESS_LIST_CONTENTS" > ./access-list.txt
+
+# Enable setting config and access list file contents at runtime
+RUN echo "#!/bin/sh\necho \"\$CONFIG_FILE_CONTENTS\" > ./config.toml\necho \"\$ACCESS_LIST_CONTENTS\" > ./access-list.txt\n./aquatic_ws -P -c ./config.toml" > entrypoint.sh && chmod +x entrypoint.sh
+
+ENTRYPOINT ["sh", "./entrypoint.sh"]