diff --git a/.github/workflows/blank.yml b/.github/workflows/blank.yml
deleted file mode 100644
index 9f4d3dc2..00000000
--- a/.github/workflows/blank.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-# This is a basic workflow to help you get started with Actions
-
-name: CI
-
-# Controls when the action will run. 
-on:
-  # Triggers the workflow on push or pull request events but only for the main branch
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
-jobs:
-  # This workflow contains a single job called "build"
-  build:
-    # The type of runner that the job will run on
-    runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
-    steps:
-      - name: Install bats
-        run: sudo apt-get install bats
-        
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
-
-      # Runs a set of commands using the runners shell
-      - name: Run bash automated test suite (bats)
-        run: |
-          docker pull curlimages/curl:latest
-          bats test/test.full.bats
-          bats test/test.mysql.bats
-          bats test/test.sqlite.bats
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
new file mode 100644
index 00000000..25b99a69
--- /dev/null
+++ b/.github/workflows/docker-publish.yml
@@ -0,0 +1,117 @@
+name: Docker
+
+on:
+  push:
+    tags: [ 'v*.*.*' ]
+    branches:
+      - main, feature/*
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+  DOCKER_REPO: ${{ vars.DOCKER_REPO || 'cachethq/docker' }}
+
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set Versions
+        uses: actions/github-script@v4
+        id: set_version
+        with:
+          script: |
+            const tag = context.ref.substring(10)
+            const no_v = tag.replace('v', '')
+            const dash_index = no_v.lastIndexOf('-')
+            const no_dash = (dash_index > -1) ?  no_v.substring(0, dash_index) : no_v
+            core.setOutput('tag', tag)
+            core.setOutput('no-v', no_v)
+            core.setOutput('no-dash', no_dash)
+
+      - id: lower-repo
+        name: Repository to lowercase
+        run: |
+          echo "repository=${GITHUB_REPOSITORY@L}" >> $GITHUB_OUTPUT
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@v3.5.0
+        with:
+          cosign-release: 'v2.2.4'
+
+      # Set up BuildKit Docker container builder to be able to build
+      # multi-platform images and export cache
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3 # v3.0.0
+
+      # Login against Docker Hub registry
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Login against a GitHub Docker registry
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5 # v5.0.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v5 # v5.0.0
+        with:
+          context: .
+          build-args: |
+            "cachet_ver=${{ github.ref_name }}"
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: |
+            ${{ env.DOCKER_REPO }}:${{steps.set_version.outputs.no-dash}}
+            ghcr.io/${{ steps.lower-repo.outputs.repository }}:${{steps.set_version.outputs.no-dash}}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..cdc4675b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+/.env
+/.idea
diff --git a/Dockerfile b/Dockerfile
index 36633d2d..b9e31398 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,9 @@
 FROM nginx:1.17.8-alpine
-
+LABEL org.opencontainers.image.description="Cachet is a beautiful and powerful open source status page system." \
+      org.opencontainers.image.authors="CachetHQ" \
+      org.opencontainers.image.url="https://cachethq.io" \
+      org.opencontainers.image.documentation="https://docs.cachethq.io" \
+      org.opencontainers.image.source="https://github.com/cachethq/cachet"
 EXPOSE 8000
 CMD ["/sbin/entrypoint.sh"]
 
diff --git a/Makefile b/Makefile
index 6c8198a1..ff8e50b4 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ SILENT :
 
 update-dependencies:
 	docker pull curlimages/curl:latest
-	docker pull postgres:9.5
+	docker pull postgres:12-alpine
 
 test:
 	bats test
diff --git a/docker-compose.yml b/docker-compose.yml
index 7691d2b5..58b2484d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,10 +10,7 @@ services:
       - POSTGRES_PASSWORD=postgres
     restart: always
   cachet:
-    build:
-      context: .
-      args:
-        - cachet_ver=2.4
+    image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest}
     ports:
       - 80:8000
     links:
diff --git a/test/docker-compose-full.yml b/test/docker-compose-full.yml
new file mode 100644
index 00000000..3a0f8c68
--- /dev/null
+++ b/test/docker-compose-full.yml
@@ -0,0 +1,36 @@
+version: "3"
+
+services:
+  postgres:
+    image: postgres:12-alpine
+    volumes:
+      - /var/lib/postgresql/data
+    environment:
+      - POSTGRES_USER=postgres
+      - POSTGRES_PASSWORD=postgres
+    restart: always
+  cachet:
+    image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest}
+    build:
+      context: ..
+      dockerfile: Dockerfile
+    ports:
+      - 8000:8000
+    links:
+      - postgres:postgres
+    environment:
+      - DB_DRIVER=pgsql
+      - DB_HOST=postgres
+      - DB_PORT=5432
+      - DB_DATABASE=postgres
+      - DB_USERNAME=postgres
+      - DB_PASSWORD=postgres
+      - DB_PREFIX=chq_
+      - APP_KEY=${APP_KEY:-null}
+      - APP_LOG=errorlog
+      - APP_ENV=${APP_ENV:-production}
+      - APP_DEBUG=false
+      - DEBUG=false
+    depends_on:
+      - postgres
+    restart: on-failure
diff --git a/test/docker-compose-mysql.yml b/test/docker-compose-mysql.yml
index e1e87d8c..35bd1f06 100644
--- a/test/docker-compose-mysql.yml
+++ b/test/docker-compose-mysql.yml
@@ -2,7 +2,7 @@ version: "3"
 
 services:
   mysql:
-    image: mariadb:10.4
+    image: mariadb:11
     environment:
       - MYSQL_ROOT_PASSWORD=mysql
       - MYSQL_USER=mysql
@@ -10,7 +10,10 @@ services:
       - MYSQL_DATABASE=mysql
       - DEBUG=false
   cachet:
-    image: docker_cachet
+    image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest}
+    build:
+      context: ..
+      dockerfile: Dockerfile
     ports:
       - 80:8000
     links:
diff --git a/test/docker-compose-sqlite.yml b/test/docker-compose-sqlite.yml
index c378e6ec..b66a6f9c 100644
--- a/test/docker-compose-sqlite.yml
+++ b/test/docker-compose-sqlite.yml
@@ -2,7 +2,10 @@ version: "3"
 
 services:
   cachet:
-    image: docker_cachet
+    image: ${DOCKER_REPO:-ghcr.io/cachethq/docker}:${APP_VERSION:-latest}
+    build:
+      context: ..
+      dockerfile: Dockerfile
     ports:
       - 80:8000
     environment:
diff --git a/test/test.full.bats b/test/test.full.bats
index 38ba0e8e..406f8728 100755
--- a/test/test.full.bats
+++ b/test/test.full.bats
@@ -5,11 +5,11 @@ load "lib/batslib"
 load "lib/output"
 
 @test "[$TEST_FILE] testing Cachet Docker image build" {
-  command docker-compose build --no-cache cachet
+  command docker-compose -f test/docker-compose-full.yml build --no-cache cachet
 }
 
 @test "[$TEST_FILE] testing Cachet docker-compose up" {
-  command docker-compose up -d
+  command docker-compose -f test/docker-compose-full.yml up -d
 }
 
 @test "[$TEST_FILE] check for container init" {
@@ -79,9 +79,9 @@ load "lib/output"
 }
 
 @test "[$TEST_FILE] restart cachet" {
-  command docker-compose stop cachet
-  command docker-compose rm -f cachet
-  command docker-compose up -d
+  command docker-compose -f test/docker-compose-full.yml stop cachet
+  command docker-compose -f test/docker-compose-full.yml rm -f cachet
+  command docker-compose -f test/docker-compose-full.yml up -d
   docker_wait_for_log docker_cachet_1 15 "INFO success: nginx entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)"
 }
 
diff --git a/test/test.mysql.bats b/test/test.mysql.bats
index 2ea73a96..7966fa31 100755
--- a/test/test.mysql.bats
+++ b/test/test.mysql.bats
@@ -13,7 +13,7 @@ load "lib/output"
 }
 
 @test "[$TEST_FILE] check for database startup" {
-  docker_wait_for_log test_mysql_1 120 "mysqld: ready for connections."
+  docker_wait_for_log test_mysql_1 120 "mariadbd: ready for connections."
 }
 
 @test "[$TEST_FILE] check for empty sessions table" {