diff --git a/.github/workflows/mcp-python-release.yml b/.github/workflows/mcp-python-release.yml
new file mode 100644
index 0000000..865c930
--- /dev/null
+++ b/.github/workflows/mcp-python-release.yml
@@ -0,0 +1,54 @@
+name: Docker Release (mcp-run-python)
+
+# Build and publish the MCP Run Python server Docker image to GHCR whenever a new
+# git tag is pushed
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read # allows reading from repo
+  packages: write # allows pushing to GHCR
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU (multi-arch builds) # needed to build for both amd64 and arm64
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          # strip leading "v" if present so that image tags are like "0.0.15"
+          VERSION=${TAG#v}
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: ./mcp-run-python
+          file: ./mcp-run-python/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            ghcr.io/pydantic/mcp-run-python:${{ steps.version.outputs.version }}
+            ghcr.io/pydantic/mcp-run-python:latest
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..eddf5d9
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,31 @@
+FROM python:3.13-slim-bookworm
+COPY --from=ghcr.io/astral-sh/uv:0.8.8 /uv /uvx /bin/
+COPY --from=docker.io/denoland/deno:bin-2.5.6 /deno /bin
+
+# Copy the project into the image
+ADD . /app
+
+# Sync the project into a new environment, using the frozen lockfile
+WORKDIR /app
+
+# Prepare the python bits
+#   'make install' also does something with precommit
+RUN uv sync --frozen --compile-bytecode
+# or rather 'make build'?
+RUN uv run build/build.py
+
+# Prepare the deno bits
+WORKDIR /app/mcp_run_python/deno
+# no deno task build defined, replaced
+RUN deno cache src/main.ts
+
+WORKDIR /app
+
+# Define default executable
+ENTRYPOINT ["uv", "run", "mcp-run-python"]
+
+# Advertise default port used in default CMD
+EXPOSE 3001
+
+# By default start streamable-http on port 3001
+CMD ["--port=3001", "streamable-http"]