diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7c59e02..f8c7372 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -12,6 +12,7 @@ on:
 jobs:
   lint:
     uses: ./.github/workflows/reusable-lint.yml
+
   build:
     uses: ./.github/workflows/reusable-build.yml
     with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..6abdabf
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,97 @@
+name: Release
+
+on:
+  push:
+    tags:
+      # The project uses PEP 440 version scheme with N.N.N release segment,
+      # {a,b,rc}N pre-release segment and .postN post-release segment
+      - "[0-9]+.[0-9]+.[0-9]+[ab][0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+.post[0-9]+"
+  workflow_dispatch:
+    inputs:
+      version:
+        required: true
+        type: string
+
+jobs:
+  set-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.set-version.outputs.version }}
+      prerelease: ${{ steps.set-version.outputs.prerelease }}
+      latest: ${{ steps.set-version.outputs.latest }}
+    steps:
+      - id: set-version
+        run: |
+          if [[ ${{ github.event_name }} = workflow_dispatch ]]; then
+            version=${{ inputs.version }}
+          else
+            version=${{ github.ref_name }}
+          fi
+          if echo $version | grep -E 'a|b|rc'; then
+            prerelease=true
+            latest=false
+          else
+            prerelease=false
+            latest=true
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "prerelease=$prerelease" >> "$GITHUB_OUTPUT"
+          echo "latest=$latest" >> "$GITHUB_OUTPUT"
+
+  lint:
+    uses: ./.github/workflows/reusable-lint.yml
+
+  build:
+    needs: [set-version]
+    uses: ./.github/workflows/reusable-build.yml
+    with:
+      version: ${{ needs.set-version.outputs.version }}
+
+  publish:
+    needs: [set-version, lint, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dstack-sshproxy
+          path: build
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          working_directory: build
+          files: dstack-sshproxy-*
+          tag_name: ${{ needs.set-version.outputs.version }}
+          generate_release_notes: true
+          prerelease: ${{ fromJSON(needs.set-version.outputs.prerelease) }}
+          make_latest: ${{ fromJSON(needs.set-version.outputs.latest) }}
+
+  docker:
+    needs: [set-version, lint, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/download-artifact@v8
+        with:
+          name: dstack-sshproxy
+          path: build
+      - run: |
+          mv dstack-sshproxy-* dstack-sshproxy
+        working-directory: build
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: true
+          tags: |
+            dstackai/sshproxy:${{ needs.set-version.outputs.version }}
+            ${{ case(fromJSON(needs.set-version.outputs.latest), 'dstackai/sshproxy:latest', '') }}
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 8e94d2d..fe27c5a 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -18,16 +18,14 @@ jobs:
           go-version-file: go.mod
           cache-dependency-path: go.sum
       - name: Build
+        env:
+          GOOS: linux
+          GOARCH: amd64
         run: |
-          scripts/build.sh build/dstack-sshproxy ${{ inputs.version }}
+          scripts/build.sh build/dstack-sshproxy-$GOOS-$GOARCH ${{ inputs.version }}
       - id: upload
         uses: actions/upload-artifact@v7
         with:
           name: dstack-sshproxy
-          path: build/dstack-sshproxy
+          path: build/dstack-sshproxy-*
           retention-days: 1
-      - name: Report
-        run: |
-          echo 'version: ${{ inputs.version }}'
-          echo 'url: ${{ steps.upload.outputs.artifact-url }}'
-          echo 'digest: ${{ steps.upload.outputs.artifact-digest }}'
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..2bc6ff7
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,5 @@
+FROM gcr.io/distroless/static-debian13
+
+COPY build/dstack-sshproxy /dstack-sshproxy
+
+ENTRYPOINT ["/dstack-sshproxy"]