diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..62a884d
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+.git
+.github
+test
+**/__pycache__
+*.py[cod]
+.pytest_cache
+*.egg-info
+.venv
+CHANGELOG.md
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..d37a1f2
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,47 @@
+name: docker
+
+on:
+  push:
+    branches: [master, dev]
+    tags: ["*.*.*", "V*", "v*"]
+  pull_request:
+    paths:
+      - Dockerfile
+      - .dockerignore
+      - pyproject.toml
+      - persona/**
+      - .github/workflows/docker.yml
+  workflow_dispatch:
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v4
+      - id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=ref,event=tag
+            type=sha,format=short
+      - uses: docker/login-action@v4
+        if: github.event_name != 'pull_request'
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..af61b23
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,35 @@
+# ovos-solver-plugin-rivescript served via ovos-persona-server.
+#
+# opm.agents.chat and neon.plugin.solver (legacy) do nothing on their own --
+# they are plugin entry points, not a server. This image runs
+# ovos-persona-server with a single persona ("rivescript-bot") that is
+# configured to use this plugin as its solver, so the image is a ready
+# OpenAI-compatible chat endpoint over RiveScript.
+FROM python:3.12-slim
+
+RUN useradd -m -u 1000 ovos
+
+WORKDIR /app
+COPY . /app
+
+# ovos-persona-server[mcp]>=0.17.0a1: from that release the [mcp] extra alone
+# no longer mounts the MCP endpoint, --mcp must be passed explicitly (see
+# ENTRYPOINT below). The plugin itself is installed from the local checkout,
+# so its version always matches the image.
+RUN pip install --no-cache-dir \
+        "ovos-persona-server[mcp]>=0.17.0a1" \
+    && pip install --no-cache-dir .
+
+USER ovos
+ENV HOME=/home/ovos
+
+EXPOSE 8337
+
+# --persona points at the bundled rivescript-bot persona, whose "solvers"
+# list names this plugin's entry point ("ovos-solver-rivescript-plugin").
+# The same name is registered under both opm.agents.chat and the legacy
+# neon.plugin.solver group; ovos-persona-server prefers the ChatEngine.
+ENTRYPOINT ["ovos-persona-server", \
+            "--persona", "/app/persona/rivescript_bot.json", \
+            "--mcp", \
+            "--port", "8337", "--host", "0.0.0.0"]
diff --git a/persona/rivescript_bot.json b/persona/rivescript_bot.json
new file mode 100644
index 0000000..a363ff1
--- /dev/null
+++ b/persona/rivescript_bot.json
@@ -0,0 +1,6 @@
+{
+  "name": "rivescript-bot",
+  "solvers": [
+    "ovos-solver-rivescript-plugin"
+  ]
+}