diff --git a/docker/Dockerfile-varnish9 b/docker/Dockerfile-varnish9
new file mode 100644
index 0000000..cd52662
--- /dev/null
+++ b/docker/Dockerfile-varnish9
@@ -0,0 +1,23 @@
+FROM varnish:9.0
+
+SHELL ["/bin/bash", "-c"]
+
+# set the user to root, and install build dependencies
+USER root
+RUN set -e && \
+    read -ra vmod_deps <<< "$VMOD_DEPS" && \
+    apt-get update && \
+    apt-get -y --no-install-recommends install "${vmod_deps[@]}" && \
+    install-vmod https://github.com/varnish/varnish-modules/releases/download/0.28.0/varnish-modules-0.28.0.tar.gz && \
+    rm -rf /var/lib/apt/lists/*
+
+COPY vendor/ibexa/http-cache/docs/varnish/vcl/varnish9.vcl /etc/varnish/default.vcl
+COPY doc/docker/entrypoint/varnish/parameters.vcl /etc/varnish/parameters.vcl
+COPY doc/docker/entrypoint/varnish/entrypoint.sh /entrypoint.sh
+
+# entrypoint.sh writes into /etc/varnish at runtime (parameters.vcl.template), so hand the
+# directory to the non-root "varnish" user the base image already runs as by default
+RUN chown -R varnish:varnish /etc/varnish
+USER varnish
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/docker/varnish9.yml b/docker/varnish9.yml
new file mode 100644
index 0000000..f4d9a88
--- /dev/null
+++ b/docker/varnish9.yml
@@ -0,0 +1,43 @@
+version: '3.3'
+
+## WARNING!
+# This service is currently work in progress, is not tested by CI, and thus not guaranteed to work.
+# You are however more then welcome to try it out and help make it stable.
+
+services:
+  app:
+    environment:
+     - APP_HTTP_CACHE=0
+     # Never do this in production if the app container is accesible for the public as well
+     # See https://developers.ibexa.co/security-advisories/ezsa-2020-002-unauthorised-cache-purge-with-misconfigured-fastly
+     - TRUSTED_PROXIES=REMOTE_ADDR
+     - HTTPCACHE_PURGE_SERVER=http://varnish
+     - HTTPCACHE_PURGE_TYPE=varnish
+
+  varnish:
+    build:
+      context: ../../
+      dockerfile: doc/docker/Dockerfile-varnish9
+    ports:
+     - "8081:80"
+    environment:
+     - VARNISH_MALLOC_SIZE=256m
+    depends_on:
+     - web
+     - app
+    networks:
+     - frontend
+     - backend
+#    command: ["--acl-add", "app", "--debug-acl-add", "app"]
+    stdin_open: true
+    tty: true
+
+## DEBUG??
+# In need of debugging all request going to Varnish, use varnishlog, example:
+#   dockercompose exec varnish varnishlog -c -i ReqURL,ReqMethod -I ReqHeader:xkey
+#  Or more relevant only PURGE's with all info:
+#   docker compose exec varnish varnishlog -g request -q "ReqMethod eq 'PURGE'"
+#
+#  But before doing that check that http and not local purge client is set:
+#   docker compose exec app bin/console --env=dev debug:container ibexa.http_cache.purge_client_internal
+#