diff --git a/.copier-answers.yml b/.copier-answers.yml
index 17e75f3..ed54a71 100644
--- a/.copier-answers.yml
+++ b/.copier-answers.yml
@@ -8,7 +8,7 @@ component_owner: group:default/sscc
 component_type: library
 description: A set of tools used for deploying applications to a shared filesystem.
 distribution_name: dls-deploy-tools
-docker: false
+docker: true
 docs_type: README
 git_platform: github.com
 github_org: DiamondLightSource
diff --git a/.github/workflows/_container.yml b/.github/workflows/_container.yml
new file mode 100644
index 0000000..da5e493
--- /dev/null
+++ b/.github/workflows/_container.yml
@@ -0,0 +1,60 @@
+on:
+  workflow_call:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Need this to get version number from last tag
+          fetch-depth: 0
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Docker Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and export to Docker local cache
+        uses: docker/build-push-action@v6
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          context: .
+          # Need load and tags so we can test it below
+          load: true
+          tags: tag_for_testing
+
+      - name: Test cli works in cached runtime image
+        run: docker run --rm tag_for_testing --version
+
+      - name: Create tags for publishing image
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=ref,event=tag
+            type=raw,value=latest
+
+      - name: Push cached image to container registry
+        if: github.ref_type == 'tag'
+        uses: docker/build-push-action@v6
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        # This does not build the image again, it will find the image in the
+        # Docker cache and publish it
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7cb8d90..0662518 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,6 +34,14 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
+  container:
+    needs: check
+    if: needs.check.outputs.branch-pr == ''
+    uses: ./.github/workflows/_container.yml
+    permissions:
+      contents: read
+      packages: write
+
   dist:
     needs: check
     if: needs.check.outputs.branch-pr == ''
diff --git a/Dockerfile b/Dockerfile
index 7c3b1fb..fcffeee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,3 +14,18 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Set up a virtual environment and put it in PATH
 RUN python -m venv /venv
 ENV PATH=/venv/bin:$PATH
+
+# The build stage installs the context into the venv
+FROM developer as build
+COPY . /context
+WORKDIR /context
+RUN touch dev-requirements.txt && pip install -c dev-requirements.txt .
+
+# The runtime stage copies the built venv into a slim runtime container
+FROM python:${PYTHON_VERSION}-slim as runtime
+# Add apt-get system dependecies for runtime here if needed
+COPY --from=build /venv/ /venv/
+ENV PATH=/venv/bin:$PATH
+
+ENTRYPOINT ["deploy-tools"]
+CMD ["--version"]
diff --git a/README.md b/README.md
index 27a9da5..0b91185 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,7 @@ access to a shared filesystem.
 Source          | <https://github.com/DiamondLightSource/deploy-tools>
 :---:           | :---:
 PyPI            | `pip install dls-deploy-tools`
+Docker          | `docker run ghcr.io/diamondlightsource/deploy-tools:latest`
 Releases        | <https://github.com/DiamondLightSource/deploy-tools/releases>
 
 The demo_configuration folder can be passed as the config_folder to the deploy-tools