diff --git a/.github/workflows/indiekit-docker.yml b/.github/workflows/indiekit-docker.yml
new file mode 100644
index 00000000..068e0d1c
--- /dev/null
+++ b/.github/workflows/indiekit-docker.yml
@@ -0,0 +1,51 @@
+name: Build Indiekit Docker container
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - indiekit/**
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  attestations: write
+
+concurrency:
+  group: "docker"
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  image-releaser:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Authenticate with Github Container Repository
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: by-jp/indiekit.byjp.me
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./indiekit
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/indiekit/.dockerignore b/indiekit/.dockerignore
new file mode 100644
index 00000000..d6e8a33c
--- /dev/null
+++ b/indiekit/.dockerignore
@@ -0,0 +1,14 @@
+# Docker
+.docker
+.dockerignore
+
+# Environment
+.env
+
+# Git
+.git
+.gitignore
+
+# Node - as they may not be the same architecture
+node_modules
+npm-debug.log
diff --git a/indiekit/Dockerfile b/indiekit/Dockerfile
new file mode 100644
index 00000000..3b70aff3
--- /dev/null
+++ b/indiekit/Dockerfile
@@ -0,0 +1,19 @@
+FROM node:20-alpine
+
+WORKDIR /usr/src/app
+ENV NODE_ENV=production
+
+COPY package*.json ./
+# Can’t use `npm ci` due to https://github.com/npm/cli/issues/4828
+RUN npm i --omit=dev --no-fund
+
+# Copy Indiekit config over
+COPY . .
+
+ENV SECRET=
+ENV PASSWORD_SECRET=
+ENV MONGO_URL=
+ENV SITE=https://www.byjp.me/
+ENV PORT=80
+EXPOSE 80
+CMD [ "npm", "run", "start" ]
diff --git a/indiekit/ecosystem.config.js b/indiekit/ecosystem.config.js
deleted file mode 100644
index 1b730c97..00000000
--- a/indiekit/ecosystem.config.js
+++ /dev/null
@@ -1,12 +0,0 @@
-const env = require('dotenv').config().parsed || {};
-
-module.exports = {
-  apps : [
-      {
-        name: "indiekit",
-        script: "npm run start",
-        watch: false,
-        env,
-      }
-  ]
-};
diff --git a/indiekit/indiekit.config.js b/indiekit/indiekit.config.js
index 90b5c6d0..ba84126b 100644
--- a/indiekit/indiekit.config.js
+++ b/indiekit/indiekit.config.js
@@ -1,5 +1,8 @@
-import dotenv from 'dotenv';
-const env = dotenv.config().parsed || {};
+const env = (await (
+  import('dotenv')
+    .then(dotenv => dotenv.config().parsed)
+    .catch(() => process.env)
+)) || {};
 
 export default {
   application: {
diff --git a/indiekit/package.json b/indiekit/package.json
index 137be352..378d4e20 100644
--- a/indiekit/package.json
+++ b/indiekit/package.json
@@ -5,8 +5,7 @@
   "main": "index.js",
   "type": "module",
   "scripts": {
-    "start": "indiekit serve",
-    "dotenv": "dotenv-run-script .env --"
+    "start": "indiekit serve"
   },
   "keywords": [
     "indiekit",