diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..fc3c142
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+.dockerignore
+.github
+.gitignore
+Dockerfile
+LICENSE
+README.md
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..0a3313a
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,15 @@
+# Start by building the application.
+FROM golang:1.18 as build
+
+WORKDIR /usr/src/wireproxy
+COPY . .
+
+RUN CGO_ENABLED=0 go build ./cmd/wireproxy
+
+# Now copy it into our base image.
+FROM gcr.io/distroless/static-debian11:nonroot
+COPY --from=build /usr/src/wireproxy/wireproxy /usr/bin/wireproxy
+
+VOLUME [ "/etc/wireproxy"]
+ENTRYPOINT [ "/usr/bin/wireproxy" ]
+CMD [ "--config", "/etc/wireproxy/config" ]
diff --git a/docker/Dockerfile b/docker/Dockerfile
deleted file mode 100644
index c435176..0000000
--- a/docker/Dockerfile
+++ /dev/null
@@ -1,14 +0,0 @@
-FROM golang:alpine AS go-build
-
-RUN apk --no-cache add --update git
-RUN git clone https://github.com/octeep/wireproxy.git
-RUN cd ./wireproxy && go build ./cmd/wireproxy
-
-
-FROM alpine:latest
-
-RUN apk upgrade
-COPY --from=go-build /go/wireproxy/wireproxy /usr/bin/
-
-VOLUME [ "/etc/wireproxy"]
-ENTRYPOINT [ "/usr/bin/wireproxy", "--config", "/etc/wireproxy/config" ]
diff --git a/docker/Makefile b/docker/Makefile
deleted file mode 100644
index f22f322..0000000
--- a/docker/Makefile
+++ /dev/null
@@ -1,10 +0,0 @@
-build:
-	docker build -t wireproxy .
-	
-run:
-	docker run \
-	--rm --tty --interactive \
-	--name=wireproxy \
-	--publish 2534:2534 \
-	--volume "${PWD}/config:/etc/wireproxy/config:ro" \
-	wireproxy
\ No newline at end of file
diff --git a/docker/config b/docker/config
deleted file mode 100644
index 0e5362f..0000000
--- a/docker/config
+++ /dev/null
@@ -1,12 +0,0 @@
-[Interface]
-Address = ###Interface - Address###
-PrivateKey = ###Interface - PrivateKey###
-DNS = ###Interface - DNS###
-
-[Peer]
-PublicKey = ###Peer - PublicKey###
-Endpoint = ###Peer - Endpoint###
-
-# Socks5 create a socks5 proxy on your LAN, and any traffic would be routed via wireguard
-[Socks5]
-BindAddress = 0.0.0.0:2534