diff --git a/.containerignore b/.containerignore
new file mode 100644
index 0000000000000000000000000000000000000000..8aad965be478e68348867d3181faa919195320bd
--- /dev/null
+++ b/.containerignore
@@ -0,0 +1,28 @@
+cert-manager-webhook-rwth
+*.config
+
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+
+.git
+.gitlab-ci.yml
+.gitignore
diff --git a/.dockerignore b/.dockerignore
new file mode 120000
index 0000000000000000000000000000000000000000..092a75da383ba36fdfd559bfd6226e1d56bdcde9
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1 @@
+.containerignore
\ No newline at end of file
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c10ee44998aed205e02aae20991bd095c30fde40..093c6f7237e53c00ffee74b00d6b6a3ec08ef304 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -28,3 +28,19 @@ lint:
     reports:
       junit: golangci-output.xml
     expire_in: 7 days
+
+build-image:
+  image:
+    name: gcr.io/kaniko-project/executor:debug
+    entrypoint: [""]
+  stage: deploy
+  before_script:
+    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
+    - /kaniko/executor version
+  script:
+    - >-
+      /kaniko/executor
+      --context $CI_PROJECT_DIR
+      --dockerfile Containerfile
+      --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
+      --destination $CI_REGISTRY_IMAGE:latest
diff --git a/Containerfile b/Containerfile
new file mode 100644
index 0000000000000000000000000000000000000000..d822377a0b8156accb6913f37f1477da43ea8499
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,21 @@
+FROM docker.io/library/golang:1-alpine AS build
+
+ARG GOARCH="amd64"
+ARG GOARM=""
+
+WORKDIR /workspace
+
+ENV GOPATH="/workspace/.go"
+
+COPY . .
+
+RUN go mod download
+
+RUN CGO_ENABLED=0 GOARCH=$GOARCH GOARM=$GOARM go build -v -o webhook -ldflags '-w -s -extldflags "-static"' .
+
+FROM scratch
+
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /workspace/webhook /webhook
+
+ENTRYPOINT ["/webhook"]