diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..c6f8745a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+.git
+build*
diff --git a/.gitmodules b/.gitmodules
index 548e642f..43fa3e96 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,3 +4,6 @@
 [submodule "third_party/googletest"]
 	path = third_party/googletest
 	url = https://github.com/google/googletest
+[submodule "docker"]
+	path = docker
+	url = https://github.com/znc/znc-docker
diff --git a/.travis.yml b/.travis.yml
index 5f38dd93..913847c3 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,10 +3,16 @@ env:
     global:
           # SECRET_KEY, used to push docs to github and to init coverity scans
         - secure: "i2f2UVDnyHT/9z0U3XvgTj8eDERvnc1Wk7HpseEjb75JwGzqn/2R+RKHmoSrwK3hFgij2IMxZL19XtHFwMz9t5A/huAAKD74KMMI/QpeZEJ/sjT3CTLcE9HEVDdJOjc7dfLRxb2hZtgvx8clZIMrpeUdPhci8openff30KvXVbg="
+          # DOCKER_USERNAME
+        - secure: "kiR372QH5Srye2beHVamOVLIPeXnDipWfzvzGJEZzbpH+aXsiD+CkbtulCR+XnKpnUAXQTmEc5ts1KjI9MGlxvP1ztxW8HMDGUMF4iFAjgZO8GyAZlH5I7pMEw7D5pn3W9y1LuCW5C9IsDcWnNTJkm32D7N34lLBCTQVw68ooDk="
+          # DOCKER_PASSWORD
+        - secure: "FMKQarGQJ/MFXnQQWEnlWMM+XItbDPgm5tzCn4k36AsAB1s1SiQ08wmy2Ys/+kRvnPN3Clpl8P2C8CoRTMJ8WCUYZVmf3HsqvsLdrODyusR5/N1y5eOKWxo+t1qN2Jzt6oIi/ofUZdn5mdzt8yif+ufxoez+2ncZDt5HoB/suHE="
 
 # These linux-specific parameters could be moved into matrix.include items, but that's lots of repetition
 sudo: required
 dist: trusty
+services:
+    - docker
 
 # See https://github.com/google/sanitizers/issues/856
 group: deprecated-2017Q3
@@ -63,7 +69,7 @@ matrix:
           install:
             - if [[ "$TRAVIS_REPO_SLUG" == "znc/znc" && "$TRAVIS_PULL_REQUEST" == "false" && "$TRAVIS_BRANCH" == "master" ]]; then ATTEMPT_DEPLOY=yes; else ATTEMPT_DEPLOY=no; fi
             - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then openssl aes-256-cbc -d -in .travis-github.enc -out ~/znc-github-key -k ${SECRET_KEY}; fi
-            - export SECRET_KEY=no
+            - export SECRET_KEY=no DOCKER_PASSWORD=no DOCKER_USERNAME=no
             - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then sudo apt-get update; fi
             - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then sudo apt-get install -y doxygen graphviz python3-yaml; fi
           script:
@@ -78,10 +84,24 @@ matrix:
             - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then ./.travis-generate-docs.sh; fi
             - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then ./.travis-coverity-scan.py; fi
           after_success:
+        - stage: deploy
+          os: linux
+          before_install:
+            - sudo apt-get update
+            - sudo apt-get -y -o Dpkg::Options::="--force-confnew" install docker-ce
+          install:
+            - if [[ "$TRAVIS_REPO_SLUG" == "znc/znc" && "$TRAVIS_PULL_REQUEST" == "false" && "$TRAVIS_BRANCH" == "docker-test" ]]; then ATTEMPT_DEPLOY=yes; else ATTEMPT_DEPLOY=no; fi
+            - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin; fi
+            - export SECRET_KEY=no DOCKER_PASSWORD=no DOCKER_USERNAME=no
+          script:
+            - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then docker build --build-arg BUILD_DATE=`date -u +"%Y-%m-%dT%H:%M:%SZ"` --build-arg VCS_REF=`git rev-parse HEAD` -t "zncbouncer/znc-git:$TRAVIS_BRANCH" -t "zncbouncer/znc-git:$TRAVIS_BRANCH-$(git describe)" .; fi
+            - if [[ "$ATTEMPT_DEPLOY" == "yes" && "$TRAVIS_BRANCH" == "master" ]]; then docker tag "zncbouncer/znc-git:$TRAVIS_BRANCH" zncbouncer/znc-git:latest; fi
+            - if [[ "$ATTEMPT_DEPLOY" == "yes" ]]; then docker push zncbouncer/znc-git; fi
+          after_success:
 before_install:
     - python -c "import fcntl; fcntl.fcntl(1, fcntl.F_SETFL, 0)"  # https://github.com/travis-ci/travis-ci/issues/8920
     - "echo os: [$TRAVIS_OS_NAME] build: [$BUILD_TYPE]"
-    - export SECRET_KEY=no
+    - export SECRET_KEY=no DOCKER_PASSWORD=no DOCKER_USERNAME=no
     - export CFGFLAGS= MYCXXFLAGS= MYLDFLAGS=
     - if [[ "$BUILD_TYPE" == "tarball" ]]; then CFGFLAGS+=" --with-gtest=$TRAVIS_BUILD_DIR/third_party/googletest/googletest --with-gmock=$TRAVIS_BUILD_DIR/third_party/googletest/googlemock --disable-swig"; fi
     - if [[ "$BUILD_TYPE" == "asan" ]]; then MYCXXFLAGS+=" -fsanitize=address -O1 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fPIE" MYLDFLAGS+=" -fsanitize=address -pie"; fi
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..0154a618
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,55 @@
+FROM alpine:3.7
+
+# musl silently doesn't support AI_ADDRCONFIG yet, and ZNC doesn't support Happy Eyeballs yet.
+# Together they cause very slow connection. So for now IPv6 is disabled here.
+ARG CMAKEFLAGS="-DCMAKE_INSTALL_PREFIX=/opt/znc -DWANT_CYRUS=YES -DWANT_PERL=YES -DWANT_PYTHON=YES -DWANT_IPV6=NO"
+ARG MAKEFLAGS=""
+
+ARG BUILD_DATE
+ARG VCS_REF
+
+LABEL org.label-schema.schema-version="1.0"
+LABEL org.label-schema.vcs-ref=$VCS_REF
+LABEL org.label-schema.vcs-url="https://github.com/znc/znc"
+LABEL org.label-schema.build-date=$BUILD_DATE
+LABEL org.label-schema.url="https://znc.in"
+
+COPY . /znc-src
+
+RUN set -x \
+    && adduser -S znc \
+    && addgroup -S znc
+RUN apk add --no-cache \
+        boost \
+        build-base \
+        ca-certificates \
+        cmake \
+        cyrus-sasl \
+        gettext \
+        icu-dev \
+        libressl-dev \
+        perl \
+        python3 \
+        su-exec \
+        tini \
+        tzdata
+RUN apk add --no-cache --virtual build-dependencies \
+        boost-dev \
+        cyrus-sasl-dev \
+        perl-dev \
+        python3-dev \
+        swig \
+    && cd /znc-src \
+    && mkdir build && cd build \
+    && cmake .. ${CMAKEFLAGS} \
+    && make $MAKEFLAGS \
+    && make install \
+    && apk del build-dependencies \
+    && cd / && rm -rf /znc-src
+
+COPY docker/slim/entrypoint.sh /
+COPY docker/*/??-*.sh /startup-sequence/
+
+VOLUME /znc-data
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/docker b/docker
new file mode 160000
index 00000000..39116f34
--- /dev/null
+++ b/docker
@@ -0,0 +1 @@
+Subproject commit 39116f34fa92cb9c9b170c60bfb32411d408a582