diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..596868ae
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+node_modules
+.git
+.gitignore
+**/*.md
+dist
+Dockerfile
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 569c53bc..20ede903 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,14 +1,17 @@
 name: Publish
-
 on:
   push:
     branches:
       - main
     paths:
       - '**/CHANGELOG.md'
-
+  workflow_dispatch:
+    inputs:
+      nocache:
+        description: 'Do not rely on existing Docker layer cache'
+        default: false
+        type: boolean
 concurrency: ${{ github.workflow }}-${{ github.ref }}
-
 jobs:
   publish:
     name: Publish
@@ -41,6 +44,33 @@ jobs:
           publish: pnpm changeset:publish
           createGithubReleases: true
 
+  docker:
+    name: Docker Image
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+
+      - name: Set up Docker
+        run: docker login --username '${{ github.actor }}' --password-stdin ghcr.io <<< "$GHCR_TOKEN"
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Configure Docker Context
+        run: docker buildx create --driver docker-container --use
+
+      - name: Build and Push Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          cache-from: type=gha,scope=prod
+          no-cache: ${{ inputs.nocache == 'true' }}
+          push: true
+          tags: |
+            ghcr.io/getsentry/spotlight:latest
+            ghcr.io/getsentry/spotlight:${{ github.sha }}
+
   electron:
     name: Electron Build
     needs: publish
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8282bc0e..a112761f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -51,6 +51,36 @@ jobs:
           path: ${{ env.CACHED_BUILD_PATHS }}
           key: ${{ env.BUILD_CACHE_KEY }}
 
+  test-docker:
+    name: Docker Test
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get changed files
+        id: changed-files-yaml
+        uses: tj-actions/changed-files@v41
+        with:
+          files_yaml: |
+            docker:
+              - Dockerfile
+
+      - name: Configure Docker Context
+        if: ${{ inputs.force || steps.changed-files-yaml.outputs.docker_any_changed == 'true' }}
+        run: docker buildx create --driver docker-container --use
+
+      - name: Build Docker Image
+        if: ${{ inputs.force || steps.changed-files-yaml.outputs.docker_any_changed == 'true' }}
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          cache-from: type=gha,scope=prod
+          cache-to: type=gha,mode=max,scope=prod
+          no-cache: ${{ inputs.nocache == 'true' }}
+
   test-unit:
     name: Unit Tests
     needs: build
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..0892b904
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+FROM node:lts-bullseye-slim AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable
+
+FROM base AS build
+WORKDIR /app
+COPY . /app
+# https://github.com/pnpm/pnpm/issues/6295
+RUN echo "dedupe-peer-dependents=false" > .npmrc
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --frozen-lockfile
+RUN pnpm run --filter="./packages/sidecar" build
+RUN pnpm deploy --filter="./packages/sidecar" --prod /deploy/sidecar
+
+FROM base as sidecar
+# FROM gcr.io/distroless/nodejs20-debian12 as sidecar
+COPY --from=build /deploy/sidecar /app
+WORKDIR /app
+EXPOSE 8969
+ENTRYPOINT [ "./server.js" ]
diff --git a/package.json b/package.json
index 1a87df81..f624cb9f 100644
--- a/package.json
+++ b/package.json
@@ -53,7 +53,7 @@
   },
   "packageManager": "pnpm@8.6.0",
   "volta": {
-    "node": "18.18.0",
+    "node": "20.10.0",
     "pnpm": "8.6.0"
   }
 }
diff --git a/packages/sidecar/server.js b/packages/sidecar/server.js
index c55011d3..3d3b818a 100755
--- a/packages/sidecar/server.js
+++ b/packages/sidecar/server.js
@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 const { setupSidecar } = await import('./dist/main.js');
-const port = process.argv[2];
+const port = process.argv.length >= 3 ? Number(process.argv[2]) : undefined;
 setupSidecar({ port });
diff --git a/packages/sidecar/src/main.ts b/packages/sidecar/src/main.ts
index 17b26420..063fb7a7 100644
--- a/packages/sidecar/src/main.ts
+++ b/packages/sidecar/src/main.ts
@@ -224,7 +224,7 @@ const buffer: MessageBuffer<Payload> = new MessageBuffer<Payload>();
 
 const isValidPort = (value: string | number) => {
   if (typeof value === 'string') {
-    const portNumber = parseInt(value, 10);
+    const portNumber = Number(value);
     return /^\d+$/.test(value) && portNumber > 0 && portNumber <= 65535;
   }
   return value > 0 && value <= 65535;
@@ -251,7 +251,7 @@ export function setupSidecar({
     logger.info('Please provide a valid port.');
     process.exit(1);
   } else if (port) {
-    sidecarPort = typeof port === 'string' ? parseInt(port, 10) : port;
+    sidecarPort = typeof port === 'string' ? Number(port) : port;
   }
 
   if (!serverInstance) {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 967208a2..44b8e0d0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1,4 +1,4 @@
-lockfileVersion: '6.0'
+lockfileVersion: '6.1'
 
 settings:
   autoInstallPeers: true