diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..fbd11a8
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,15 @@
+*
+*/
+
+# not ignore go and cue files
+!cmd/
+!cue/
+!cuego/
+!encoding/
+!internal/
+!pkg/
+!tools/
+
+# not ignore go module files
+!go.mod
+!go.sum
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..a55ec1f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,28 @@
+# target: cue-builder
+ARG GOLANG_VERSION
+FROM docker.io/golang:${GOLANG_VERSION}-alpine AS cue-builder
+ARG CUE_VERSION
+ENV \
+	OUTDIR='/out' \
+	GO111MODULE='on'
+RUN set -eux && \
+	apk add --no-cache \
+		git
+WORKDIR /go/src/cuelang.org/go
+COPY go.mod /go/src/cuelang.org/go/
+COPY go.sum /go/src/cuelang.org/go/
+RUN set -eux && \
+	go mod download
+COPY . /go/src/cuelang.org/go/
+RUN set -eux && \
+	CGO_ENABLED=0 GOBIN=${OUTDIR}/usr/bin/ go install \
+		-a -v \
+		-tags='osusergo,netgo' \
+		-installsuffix='netgo' \
+		-ldflags="-s -w -X cuelang.org/go/cmd/cue/cmd.version=${CUE_VERSION} \"-extldflags=-static\"" \
+	./cmd/cue
+
+# target: cue
+FROM gcr.io/distroless/static:latest AS cue
+COPY --from=cue-builder /out/ /
+ENTRYPOINT ["/usr/bin/cue"]