diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d616e02..b00ef8d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -78,3 +78,51 @@ jobs:
           files: packages/*
           draft: ${{ github.ref_type != 'tag' }}
           prerelease: ${{ github.ref_type != 'tag' }}
+
+  docker:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu24.04
+    needs:
+      - init
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.1.1
+        with:
+          ref: ${{ github.event.inputs.ref }}
+      - name: Compute RUN_FROM
+        id: run_from
+        run: |
+          RUN_FROM=$(./scripts/compute-run-from.sh ${{ matrix.os }})
+          echo "RUN_FROM=$RUN_FROM" | tee -a "$GITHUB_OUTPUT"
+
+      - name: Docker Metadata action
+        uses: docker/metadata-action@v5.5.1
+        id: meta
+        with:
+          images: |
+            ghcr.io/${{ github.repository }}
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Build and push Docker images
+        uses: docker/build-push-action@v6.9.0
+        with:
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            BUILD_FROM=ghcr.io/emqx/emqx-builder/${{ needs.init.outputs.BUILDER_VSN }}:${{ needs.init.outputs.ELIXIR_VSN }}-${{ needs.init.outputs.OTP_VSN }}-${{ matrix.os }}
diff --git a/.gitignore b/.gitignore
index 1977724..1a969da 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,4 @@ rebar.lock
 Mnesia*
 TAGS
 emqx-export*.tar.gz
+/dist/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..048d637
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+ARG BUILD_FROM
+ARG RUN_FROM=ubuntu:24.04
+
+FROM ${BUILD_FROM} AS builder
+
+COPY . /build
+
+WORKDIR /build
+
+RUN /build/build
+
+FROM ${RUN_FROM} AS runner
+
+WORKDIR /opt/converter
+
+COPY --from=builder /build/dist/. /opt/converter/.
+
+ENTRYPOINT ["/opt/converter/bin/emqx_data_converter"]
diff --git a/build b/build
new file mode 100755
index 0000000..4a0ef11
--- /dev/null
+++ b/build
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+rebar3 escriptize
+
+DIST_DIR="${DIST_DIR:-dist}"
+
+ERL_ROOT=$(erl -noinput -eval 'io:format("~s",[code:root_dir()]),halt().')
+ERL_DIR=$(basename $ERL_ROOT)
+rm -rf "$DIST_DIR"
+cp -R ${ERL_ROOT%/} _build/
+mv _build/default/bin/emqx_data_converter _build/$ERL_DIR/bin/emqx_data_converter.escript
+cp -f _build/$ERL_DIR/bin/escript _build/$ERL_DIR/bin/emqx_data_converter
+mkdir "$DIST_DIR"
+mv _build/$ERL_DIR/* "$DIST_DIR/."
diff --git a/package b/package
index 63348ee..394ecb4 100755
--- a/package
+++ b/package
@@ -2,17 +2,13 @@
 
 set -euo pipefail
 
-rebar3 escriptize
-
+export DIST_DIR="dist"
 ERL_ROOT=$(erl -noinput -eval 'io:format("~s",[code:root_dir()]),halt().')
 ERL_DIR=$(basename $ERL_ROOT)
-rm -rf _build/emqx_data_converter
-cp -R ${ERL_ROOT%/} _build/
-mv _build/default/bin/emqx_data_converter _build/$ERL_DIR/bin/emqx_data_converter.escript
-cp -f _build/$ERL_DIR/bin/escript _build/$ERL_DIR/bin/emqx_data_converter
-mkdir _build/emqx_data_converter
-mv _build/$ERL_DIR/* _build/emqx_data_converter
-tar -czf _build/emqx_data_converter.tar.gz -C _build emqx_data_converter
+
+./build
+
+tar -czf _build/emqx_data_converter.tar.gz -C "$DIST_DIR" .
 rm -rf _build/emqx_data_converter
 rm -rf _build/$ERL_DIR
 
diff --git a/scripts/compute-run-from.sh b/scripts/compute-run-from.sh
new file mode 100755
index 0000000..077994f
--- /dev/null
+++ b/scripts/compute-run-from.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+case "$1" in
+  ubuntu*)
+    VSN=${1#ubuntu}
+    echo "ubuntu:$VSN"
+    ;;
+  *)
+    echo "unsupported OS: $1"
+    exit 1
+    ;;
+esac