diff --git a/.circleci/config.yml b/.circleci/config.yml
index 0ff9559365e..6a82e96b7d0 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -4,7 +4,7 @@ parameters:
 defaults: &defaults
   resource_class: large
   docker:
-      - image: bepsays/ci-hugoreleaser:1.22300.20000
+      - image: bepsays/ci-hugoreleaser:1.22300.20200
 environment: &buildenv
       GOMODCACHE: /root/project/gomodcache
 version: 2
@@ -60,7 +60,7 @@ jobs:
     environment:
         <<: [*buildenv]
     docker:
-    - image: bepsays/ci-hugoreleaser-linux-arm64:1.22300.20000
+    - image: bepsays/ci-hugoreleaser-linux-arm64:1.22300.20200
     steps:
       - *restore-cache
       - &attach-workspace
diff --git a/Dockerfile b/Dockerfile
index afe5cf1322c..a8ac4551036 100755
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,55 +3,76 @@
 # Website:      https://gohugo.io/
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.5.0 AS xx
-
-FROM --platform=$BUILDPLATFORM golang:1.22.6-alpine AS build
+FROM --platform=$BUILDPLATFORM golang:1.23.2-alpine AS base
+FROM base AS build
 
 # Set up cross-compilation helpers
 COPY --from=xx / /
-RUN apk add clang lld
 
-# Optionally set HUGO_BUILD_TAGS to "extended" or "nodeploy" when building like so:
-#   docker build --build-arg HUGO_BUILD_TAGS=extended .
-ARG HUGO_BUILD_TAGS="none"
+# gcc/g++ are required to build libsass and libwebp libraries for the extended version.
+RUN xx-apk add --no-scripts --no-cache gcc g++
 
-ARG CGO=1
-ENV CGO_ENABLED=${CGO}
-ENV GOOS=linux
-ENV GO111MODULE=on
+# Optionally set HUGO_BUILD_TAGS to "none" or "nodeploy" when building like so:
+# docker build --build-arg HUGO_BUILD_TAGS=nodeploy .
+#
+# We build the extended version by default.
+ARG HUGO_BUILD_TAGS="extended"
+ENV GOPROXY=https://proxy.golang.org
+ENV GOCACHE=/root/.cache/go-build
+ENV GOMODCACHE=/go/pkg/mod
 
 WORKDIR /go/src/github.com/gohugoio/hugo
 
-RUN --mount=src=go.mod,target=go.mod \
-    --mount=src=go.sum,target=go.sum \
-    --mount=type=cache,target=/go/pkg/mod \
-    go mod download
-
-ARG TARGETPLATFORM
-# gcc/g++ are required to build SASS libraries for extended version
-RUN xx-apk add --no-scripts --no-cache gcc g++ musl-dev git
 RUN --mount=target=. \
-    --mount=type=cache,target=/go/pkg/mod <<EOT
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build <<EOT
     set -ex
-    xx-go build -tags "$HUGO_BUILD_TAGS" -o /usr/bin/hugo
+    xx-go build -tags "$HUGO_BUILD_TAGS" -ldflags "-s -w -X github.com/gohugoio/hugo/common/hugo.vendorInfo=docker" -o /usr/bin/hugo
     xx-verify /usr/bin/hugo
 EOT
 
-# ---
-
-FROM alpine:3.18
+FROM base AS final
 
 COPY --from=build /usr/bin/hugo /usr/bin/hugo
 
-# libc6-compat & libstdc++ are required for extended SASS libraries
-# ca-certificates are required to fetch outside resources (like Twitter oEmbeds)
-RUN apk update && \
-    apk add --no-cache ca-certificates libc6-compat libstdc++ git
+# libc6-compat & libstdc++ are required for extended libraries (libsass, libwebp).
+RUN apk add --no-cache \
+    libc6-compat \
+    libstdc++ \
+    git \
+    runuser \
+    curl \
+    nodejs \
+    npm
+
+RUN mkdir -p /var/hugo/bin && \
+    addgroup -Sg 1000 hugo && \
+    adduser -Sg hugo -u 1000 -h /var/hugo hugo && \
+    chown -R hugo: /var/hugo && \
+    runuser -u hugo -- git config --global --add safe.directory /project
 
-VOLUME /site
-WORKDIR /site
+VOLUME /project
+WORKDIR /project
+USER hugo:hugo
+ENV HUGO_CACHEDIR=/cache
+ARG BUILDARCH
+ENV BUILDARCH=${BUILDARCH}
+
+COPY scripts/docker scripts/docker
+
+# Install default dependencies.
+RUN scripts/docker/install_runtimedeps_default.sh
+
+COPY scripts/docker/entrypoint.sh /entrypoint.sh
+
+ENV PATH="/var/hugo/bin:/var/hugo/bin/dart-sass:$PATH"
+
+RUN sass --version
+RUN hugo version
 
 # Expose port for live server
 EXPOSE 1313
 
-ENTRYPOINT ["hugo"]
+ENTRYPOINT ["/entrypoint.sh"]
 CMD ["--help"]
+
diff --git a/notesdocker.md b/notesdocker.md
new file mode 100644
index 00000000000..7e897593089
--- /dev/null
+++ b/notesdocker.md
@@ -0,0 +1,34 @@
+docker run --rm -v .:/project -v $HOME/Library/Caches/hugo_cache:/cache  -u $(id -u):$(id -g) testing_bullseye build
+
+
+docker build -t testing_alpine .
+
+                   
+docker run --rm -v .:/project -v $HOME/Library/Caches/hugo_cache:/cache -p 1313:1313 testing_alpine server --bind="0.0.0.0"
+
+
+This is the entry point file:
+
+```sh
+#!/bin/sh
+
+# Check if a custom hugo-docker-entrypoint.sh file exists.
+if [ -f hugo-docker-entrypoint.sh ]; then
+  # Execute the custom entrypoint file.
+  sh hugo-docker-entrypoint.sh "$@"
+  exit $?
+fi
+
+# Check if a package.json file exists.
+if [ -f package.json ]; then
+  # Check if node_modules exists.
+  if [ ! -d node_modules ]; then
+    # Install npm packages.
+    npm i
+  fi
+fi
+
+exec "hugo" "$@"
+```
+
+If a custom `hugo-docker-entrypoint.sh` script exists in the root of the Hugo project, that script will be executed instead of the default entrypoint script. 
\ No newline at end of file
diff --git a/scripts/docker/entrypoint.sh b/scripts/docker/entrypoint.sh
new file mode 100755
index 00000000000..20ffbe5f76d
--- /dev/null
+++ b/scripts/docker/entrypoint.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Check if a custom hugo-docker-entrypoint.sh file exists.
+if [ -f hugo-docker-entrypoint.sh ]; then
+  # Execute the custom entrypoint file.
+  sh hugo-docker-entrypoint.sh "$@"
+  exit $?
+fi
+
+# Check if a package.json file exists.
+if [ -f package.json ]; then
+  # Check if node_modules exists.
+  if [ ! -d node_modules ]; then
+    # Install npm packages.
+    # Note that we deliberately do not use `npm ci` here, as it would fail if the package-lock.json file is not up-to-date,
+    # which would be the case if you run the container with a different OS or architecture than the one used to create the package-lock.json file.
+    npm i
+  fi
+fi
+
+exec "hugo" "$@"
\ No newline at end of file
diff --git a/scripts/docker/install_runtimedeps_default.sh b/scripts/docker/install_runtimedeps_default.sh
new file mode 100755
index 00000000000..0b6c2c61708
--- /dev/null
+++ b/scripts/docker/install_runtimedeps_default.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -ex
+
+export DART_SASS_VERSION=1.79.3
+
+# If $BUILDARCH=arm64, then we need to install the arm64 version of Dart Sass,
+# otherwise we install the x64 version.
+ARCH="x64"
+if [ "$BUILDARCH" = "arm64" ]; then
+    ARCH="arm64"
+fi
+
+cd /tmp
+curl -LJO https://github.com/sass/dart-sass/releases/download/${DART_SASS_VERSION}/dart-sass-${DART_SASS_VERSION}-linux-${ARCH}.tar.gz 
+ls -ltr
+tar -xf dart-sass-${DART_SASS_VERSION}-linux-${ARCH}.tar.gz
+rm dart-sass-${DART_SASS_VERSION}-linux-${ARCH}.tar.gz && \
+# The dart-sass folder is added to the PATH by the caller.
+mv dart-sass /var/hugo/bin
\ No newline at end of file