diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..c552e57
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+.git
+.github
+.gitignore
+Dockerfile*
+LICENSE
+README.md
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..a658a6e
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,40 @@
+name: Docker
+
+on:
+  pull_request:
+    paths:
+      - ".dockerignore"
+      - ".github/workflows/docker.yml"
+      - "Dockerfile"
+      - "**/*.go"
+      - "go.mod"
+      - "go.sum"
+  push:
+    branches:
+      - master
+    paths:
+      - ".dockerignore"
+      - ".github/workflows/docker.yml"
+      - "Dockerfile"
+      - "**/*.go"
+      - "go.mod"
+      - "go.sum"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Build image
+        run: docker build --tag getjs:test .
+
+      - name: Smoke test stdin extraction
+        run: |
+          printf '%s\n' '<script src="/app.js"></script>' \
+            | docker run --rm --interactive getjs:test \
+            | grep --fixed-strings --line-regexp '/app.js'
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..02dc6bf
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,27 @@
+# syntax=docker/dockerfile:1
+
+FROM --platform=$BUILDPLATFORM golang:1.27.0-bookworm AS build
+
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download && go mod verify
+
+COPY . .
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
+    go build -trimpath -ldflags="-s -w" -o /out/getjs .
+
+FROM scratch
+
+LABEL org.opencontainers.image.source="https://github.com/003random/getJS" \
+      org.opencontainers.image.description="Extract JavaScript sources from URLs and HTTP responses" \
+      org.opencontainers.image.licenses="MIT"
+
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build --chown=65532:65532 /out/getjs /getjs
+
+USER 65532:65532
+ENTRYPOINT ["/getjs"]
diff --git a/README.md b/README.md
index 87b509f..419cd9d 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,7 @@ This is a powerful tool for extracting JavaScript sources from URLs, web pages,
 ## Table of Contents
 
 - [Installation](#installation)
+- [Docker](#docker)
 - [CLI Usage](#cli-usage)
   - [Options](#options)
   - [Examples](#examples)
@@ -33,6 +34,40 @@ To install `getJS`, use the following command:
 
 `go install github.com/003random/getJS/v2@latest`
 
+## Docker
+
+Build the image from the repository root:
+
+```sh
+docker build -t getjs:local .
+```
+
+Run getJS against a URL:
+
+```sh
+docker run --rm getjs:local -url https://example.com
+```
+
+When piping a URL or HTTP response into the container, keep stdin open with
+`--interactive`:
+
+```sh
+curl https://example.com | docker run --rm --interactive getjs:local
+```
+
+Mount URL-list files read-only and refer to them by their container path:
+
+```sh
+docker run --rm --volume "${PWD}:/data:ro" getjs:local -input /data/urls.txt
+```
+
+Results are written to stdout by default, so they can be saved on the host
+without granting the container write access:
+
+```sh
+docker run --rm getjs:local -url https://example.com > results.txt
+```
+
 ## CLI Usage
 
 ### Options