diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
new file mode 100644
index 000000000..d9f19c38d
--- /dev/null
+++ b/.github/workflows/container.yml
@@ -0,0 +1,52 @@
+name: Container building for ghcr.io
+
+on:
+  push:
+    branches: ["dev", "staging"]
+    tags:
+      - v*
+
+jobs:
+  build:
+    uses: docker/github-builder/.github/workflows/build.yml@v1
+    permissions:
+      contents: read # for checkout
+      packages: write # to upload build to GHCR
+      id-token: write # signing attestations with github oidc token
+    with:
+      output: image
+      push: true
+      context: .
+      platforms: linux/amd64,linux/arm64
+      cache: true
+      cache-mode: max
+      fail-fast: true
+      sbom: true
+      sign: false
+      cache-scope: pixelfed
+      meta-images: ghcr.io/${{ github.repository_owner }}/pixelfed
+      meta-tags: |
+        type=semver,pattern=v{{version}}
+        type=ref,event=branch
+      meta-flavor: |
+        latest=${{ startsWith(github.ref, 'refs/tags/') }}
+      set-meta-labels: true
+      set-meta-annotations: true
+    secrets:
+      registry-auths: |
+        - registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+  cleanup:
+    needs: build
+    if: ${{ github.ref_type == 'branch' }}
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+
+    steps:
+      - uses: dataaxiom/ghcr-cleanup-action@v1
+        with:
+          package: pixelfed
+          delete-untagged: true
+          older-than: 1 hour