diff --git a/cmd/server/Dockerfile b/cmd/server/Dockerfile
new file mode 100644
index 0000000..55890a0
--- /dev/null
+++ b/cmd/server/Dockerfile
@@ -0,0 +1,26 @@
+FROM golang:latest as builder
+
+ENV CGO_ENABLED=0
+
+ENV GO111MODULE=on
+ENV GOPROXY=https://proxy.golang.org
+
+RUN mkdir /gocache
+ENV GOCACHE /gocache
+
+WORKDIR /go/src/gomodules.avm99963.com/twpt-server
+COPY go.mod /go/src/gomodules.avm99963.com/twpt-server/go.mod
+COPY go.sum /go/src/gomodules.avm99963.com/twpt-server/go.sum
+COPY cmd /go/src/gomodules.avm99963.com/twpt-server/cmd
+COPY internal /go/src/gomodules.avm99963.com/twpt-server/internal
+COPY api_proto /go/src/gomodules.avm99963.com/twpt-server/api_proto
+
+WORKDIR /go/src/gomodules.avm99963.com/twpt-server/cmd/server
+RUN go install gomodules.avm99963.com/twpt-server/cmd/server
+
+FROM alpine
+LABEL maintainer "me@avm99963.com"
+
+RUN apk add --no-cache tini
+COPY --from=builder /go/bin/server /
+ENTRYPOINT ["/sbin/tini", "--", "/server"]
diff --git a/cmd/server/server.go b/cmd/server/server.go
index 06c90b8..c6272f3 100644
--- a/cmd/server/server.go
+++ b/cmd/server/server.go
@@ -89,7 +89,7 @@
 	token := authorization[0]
 	payload, err := s.jwtValidator.Validate(ctx, token, *jwtAudience)
 	if err != nil {
-		return nil, status.Errorf(codes.Unauthenticated, "getAuthenticatedUser: can't parse idtoken")
+		return nil, status.Errorf(codes.Unauthenticated, "getAuthenticatedUser: can't parse or validate idtoken")
 	}
 
 	var authorizedUsers []*pb.KillSwitchAuthorizedUser
@@ -345,7 +345,7 @@
 func main() {
 	flag.Parse()
 
-	lis, err := net.Listen("tcp", fmt.Sprintf("localhost:%d", *port))
+	lis, err := net.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", *port))
 	if err != nil {
 		log.Fatalf("Failed to listen: %v", err)
 	}