diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b847670
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,41 @@
+FROM alpine:3.20.1 AS builder
+
+ARG LIGHTTPD_TARBALL="https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.76.tar.gz"
+ARG LIGHTTPD_SHA256="ba14a030889518194fd88b33e419d51cc38c8fe917126d5a7a965be79b53e995"
+
+RUN set -eux; \
+  \
+  apk add --no-cache \
+    bsd-compat-headers \
+    build-base \
+    pcre2-dev \
+    scons
+
+RUN set -eux; \
+  \
+  wget -O lighttpd.tar.gz "$LIGHTTPD_TARBALL"; \
+  echo "$LIGHTTPD_SHA256 *lighttpd.tar.gz" | sha256sum -c; \
+  mkdir -p /usr/src/lighttpd; \
+  tar -xzf lighttpd.tar.gz -C /usr/src/lighttpd --strip-components=1; \
+  rm lighttpd.tar.gz; \
+  cd /usr/src/lighttpd; \
+  nproc="$(getconf _NPROCESSORS_ONLN)"; \
+  eval "scons -j '$nproc' build_fullstatic=1 build_dynamic=0"
+
+RUN set -eux; \
+  \
+  mkdir -p /rootfs/bin; \
+  cp /usr/src/lighttpd/sconsbuild/fullstatic/build/lighttpd /rootfs/bin/; \
+  mkdir -p /rootfs/etc; \
+  echo "nogroup:*:10001:nobody" > /rootfs/etc/group; \
+  echo "nobody:*:10001:10001:::" > /rootfs/etc/passwd
+
+
+FROM scratch
+
+COPY --from=builder --chown=10001:10001 /rootfs /
+
+USER 10001:10001
+
+ENTRYPOINT ["/bin/lighttpd"]
+CMD ["-D", "-f", "/lighttpd.conf"]