diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7ce80ae
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+FROM golang:1.20 AS build-stage
+
+WORKDIR /gomod
+COPY go.mod go.sum ./
+RUN go mod download
+
+RUN mkdir -p /output
+
+WORKDIR /kperf-build
+RUN --mount=source=./,target=/kperf-build,rw make build && PREFIX=/output make install
+
+FROM gcr.io/distroless/static-debian12:nonroot AS release-stage
+
+WORKDIR /
+
+COPY --from=build-stage /output/bin/kperf /kperf
+
+USER nonroot:nonroot
+
+ENTRYPOINT ["/kperf"]
diff --git a/Makefile b/Makefile
index 8c0049b..b357424 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,15 @@
 COMMANDS=kperf
 
+# PREFIX is base path to install.
+PREFIX ?= /usr/local
+
+GO_BUILDTAGS = -tags "osusergo netgo static_build"
+
+# IMAGE_REPO is default repo for image-build recipe.
+IMAGE_REPO ?= localhost:5000
+IMAGE_TAG ?= latest
+IMAGE_NAME = $(IMAGE_REPO)/kperf:$(IMAGE_TAG)
+
 BINARIES=$(addprefix bin/,$(COMMANDS))
 
 # default recipe is build
@@ -9,11 +19,23 @@ BINARIES=$(addprefix bin/,$(COMMANDS))
 ALWAYS:
 
 bin/%: cmd/% ALWAYS
-	@go build -o $@ ./$<
+	@GO_ENABLED=0 go build -o $@ ${GO_BUILDTAGS} ./$<
 
 build: $(BINARIES) ## build binaries
 	@echo "$@"
 
+install: ## install binaries
+	@install -d $(PREFIX)/bin
+	@install $(BINARIES) $(PREFIX)/bin
+
+image-build: ## build image
+	@echo building ${IMAGE_NAME}
+	@docker build . -t ${IMAGE_NAME}
+
+image-push: image-build ## push image
+	@echo pushing ${IMAGE_NAME}
+	@docker push ${IMAGE_NAME}
+
 test: ## run test
 	@go test -v ./...