diff --git a/.github/ci.yaml b/.github/ci.yaml
new file mode 100644
index 000000000..0600f8296
--- /dev/null
+++ b/.github/ci.yaml
@@ -0,0 +1,19 @@
+name: Build and publish to ECR
+
+on:
+  workflow_dispatch:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "Jenkinsfile"
+      - ".git**"
+
+jobs:
+  build-publish-image-to-ecr:
+    uses: alphagov/govuk-infrastructure/.github/workflows/ci-ecr.yaml@main
+    secrets:
+      AWS_GOVUK_ECR_ACCESS_KEY_ID: ${{ secrets.AWS_GOVUK_ECR_ACCESS_KEY_ID }}
+      AWS_GOVUK_ECR_SECRET_ACCESS_KEY: ${{ secrets.AWS_GOVUK_ECR_SECRET_ACCESS_KEY }}
diff --git a/Dockerfile b/Dockerfile
index 42ae69235..63967435b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,24 +1,44 @@
-FROM ruby:2.7.5
-RUN apt-get update -qq && apt-get upgrade -y
-RUN apt-get install -y build-essential nodejs && apt-get clean
-RUN gem install foreman
+ARG base_image=ruby:2.7.5-slim
 
-ENV GOVUK_APP_NAME government-frontend
-ENV PORT 3090
-ENV RAILS_ENV development
+FROM $base_image AS builder
 
-ENV APP_HOME /app
-RUN mkdir $APP_HOME
+ENV RAILS_ENV=production
+# TODO: have a separate build image which already contains the build-only deps.
+RUN apt-get update -qy && \
+    apt-get upgrade -y && \
+    apt-get install -y build-essential nodejs && \
+    apt-get clean 
+    
+RUN bundle config set force_ruby_platform true
 
-WORKDIR $APP_HOME
-ADD Gemfile* $APP_HOME/
-ADD .ruby-version $APP_HOME/
-RUN bundle install
+RUN mkdir /app
 
-ADD . $APP_HOME
+WORKDIR /app
 
-RUN GOVUK_WEBSITE_ROOT=https://www.gov.uk GOVUK_APP_DOMAIN=www.gov.uk RAILS_ENV=production bundle exec rails assets:precompile
+COPY Gemfile Gemfile.lock .ruby-version /app/
 
-HEALTHCHECK CMD curl --silent --fail localhost:$PORT/healthcheck/ready || exit 1
+RUN bundle config set deployment 'true' && \
+    bundle config set without 'development test' && \
+    bundle install --jobs 4 --retry=2
 
-CMD foreman run web
+COPY . /app
+# TODO: We probably don't want assets in the image; remove this once we have a proper deployment process which uploads to (e.g.) S3.
+RUN GOVUK_APP_DOMAIN=www.gov.uk \
+    GOVUK_WEBSITE_ROOT=https://www.gov.uk \
+    bundle exec rails assets:precompile
+
+FROM $base_image
+
+ENV RAILS_ENV=production GOVUK_APP_NAME=government-frontend GOVUK_APP_DOMAIN=www.gov.uk GOVUK_WEBSITE_ROOT=https://www.gov.uk PORT=3090
+
+RUN apt-get update -qy && \
+    apt-get upgrade -y && \
+    apt-get install -y nodejs && \
+    apt-get clean
+
+WORKDIR /app
+
+COPY --from=builder /usr/local/bundle/ /usr/local/bundle/
+COPY --from=builder /app ./
+
+CMD bundle exec puma
diff --git a/config/puma.rb b/config/puma.rb
new file mode 100644
index 000000000..d08b16a62
--- /dev/null
+++ b/config/puma.rb
@@ -0,0 +1,2 @@
+require "govuk_app_config/govuk_puma"
+GovukPuma.configure_rails(self)