diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..6b8710a7
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1 @@
+.git
diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
deleted file mode 100644
index 9f6b2d6c..00000000
--- a/.github/workflows/build-test.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: Build Debos and run tests
-on: [pull_request, push]
-
-jobs:
-  build-test:
-    name: Build Debos and run tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Repository checkout
-        uses: actions/checkout@v2
-
-      - name: Build container
-        run: |
-          docker build -f docker/Dockerfile -t godebos/debos .
-
-      - name: Run unit tests
-        run: |
-          docker-compose -f docker/unit-tests.test.yml \
-            up --build --exit-code-from=sut
-
-      - name: Run test recipes on host
-        run: |
-          docker-compose -f docker/recipes.test.yml \
-            up --build --exit-code-from=sut
-
-      - name: Run test recipes using UML backend
-        run: |
-          docker-compose -f docker/recipes-test-uml.yml \
-            up --build --exit-code-from=sut
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
new file mode 100644
index 00000000..9f4eec98
--- /dev/null
+++ b/.github/workflows/docker-publish.yml
@@ -0,0 +1,200 @@
+name: Build, test and deploy
+
+on:
+  push:
+    branches: [ master ]
+    tags: [ 'v*.*.*' ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+    ~
+
+env:
+  DOCKERHUB_TAG: edscollabora/debos
+  GITHUB_TAG: ghcr.io/${{ github.repository_owner }}/debos
+  TEST_TAG: ${{ github.repository }}
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Repository checkout
+        uses: actions/checkout@v2
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Use cache
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.build-cache
+          key: ${{ runner.os }}-docker-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-docker-
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: false
+          file: docker/Dockerfile
+          cache-from: type=local,src=/tmp/.build-cache
+          cache-to: type=local,dest=/tmp/.build-cache,mode=max
+
+  unit-test:
+    name: Run unit tests
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Repository checkout
+        uses: actions/checkout@v2
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Use cache
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.build-cache
+          key: ${{ runner.os }}-docker-${{ github.sha }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: false
+          tags: ${{ env.TEST_TAG }}:builder
+          file: docker/Dockerfile
+          cache-from: type=local,src=/tmp/.build-cache
+          load: true
+          target: builder
+
+      - name: Run unit tests
+        run: |
+          docker-compose -f docker/unit-tests.test.yml \
+            up --exit-code-from=sut
+        env:
+          IMAGE: ${{ env.TEST_TAG }}:builder
+
+  recipe-test:
+    name: Run recipe tests
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Repository checkout
+        uses: actions/checkout@v2
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Use cache
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.build-cache
+          key: ${{ runner.os }}-docker-${{ github.sha }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: false
+          tags: ${{ env.TEST_TAG }}
+          file: docker/Dockerfile
+          cache-from: type=local,src=/tmp/.build-cache
+          load: true
+
+      - name: Run test recipes on host
+        run: |
+          docker-compose -f docker/recipes.test.yml \
+            up --exit-code-from=sut
+        env:
+          IMAGE: ${{ env.TEST_TAG }}
+
+  uml-test:
+    name: Run UML tests
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Repository checkout
+        uses: actions/checkout@v2
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Use cache
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.build-cache
+          key: ${{ runner.os }}-docker-${{ github.sha }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: false
+          tags: ${{ env.TEST_TAG }}
+          file: docker/Dockerfile
+          cache-from: type=local,src=/tmp/.build-cache
+          load: true
+
+      - name: Run test recipes using UML backend
+        run: |
+          docker-compose -f docker/recipes-test-uml.yml \
+            up --exit-code-from=sut
+        env:
+          IMAGE: ${{ env.TEST_TAG }}
+
+  publish:
+    name: Publish
+    needs:
+      - unit-test
+      - recipe-test
+      - uml-test
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          images: ${{ env.DOCKERHUB_TAG }},${{ env.GITHUB_TAG }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Use cache
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.build-cache
+          key: ${{ runner.os }}-docker-${{ github.sha }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          file: docker/Dockerfile
+          cache-from: type=local,src=/tmp/.build-cache
diff --git a/docker/recipes-test-uml.yml b/docker/recipes-test-uml.yml
index ff28598f..d0d46c93 100644
--- a/docker/recipes-test-uml.yml
+++ b/docker/recipes-test-uml.yml
@@ -5,7 +5,8 @@ services:
     build:
       context: ..
       dockerfile: docker/Dockerfile
-      target: runner
+    image:
+      "${IMAGE}"
     volumes:
       - type: bind
         source: ../tests
diff --git a/docker/recipes.test.yml b/docker/recipes.test.yml
index d10cb74b..9a3b754a 100644
--- a/docker/recipes.test.yml
+++ b/docker/recipes.test.yml
@@ -5,7 +5,8 @@ services:
     build:
       context: ..
       dockerfile: docker/Dockerfile
-      target: runner
+    image:
+      "${IMAGE}"
     volumes:
       - type: bind
         source: ../tests
diff --git a/docker/unit-tests.test.yml b/docker/unit-tests.test.yml
index 3eaec86c..23f65dc3 100644
--- a/docker/unit-tests.test.yml
+++ b/docker/unit-tests.test.yml
@@ -6,5 +6,7 @@ services:
       context: ..
       dockerfile: docker/Dockerfile
       target: builder
+    image:
+      "${IMAGE}"
     working_dir: /usr/local/go/src/github.com/go-debos/debos
     command: go test -v ./...