diff --git a/.space.kts b/.space.kts
new file mode 100644
index 0000000..d990d3d
--- /dev/null
+++ b/.space.kts
@@ -0,0 +1,17 @@
+job("Docker") {
+    host("Build and push a Docker image") {
+        shellScript {
+            content = """
+                export DOCKER_CLI_EXPERIMENTAL=enabled;
+                docker buildx create --name boxitkeycloak || true 2>/dev/null;
+                docker buildx use boxitkeycloak;
+                docker buildx build \
+                --platform linux/arm64,linux/amd64 \
+                --tag boxi.registry.jetbrains.space/p/boxit/containers/boxit-keycloak:0.0.${"$"}JB_SPACE_EXECUTION_NUMBER \
+                --push \
+                .;
+            """.trimIndent()
+        }
+    }
+}
+
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..bd70440
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,26 @@
+FROM quay.io/keycloak/keycloak:26.0 as builder
+
+# Enable health and metrics support
+ENV KC_HEALTH_ENABLED=true
+ENV KC_METRICS_ENABLED=true
+
+# Configure a database vendor
+ENV KC_DB=postgres
+
+WORKDIR /opt/keycloak
+# for demonstration purposes only, please make sure to use proper certificates in production instead
+RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=keycloak" -alias server -ext "SAN:c=DNS:localhost,IP:127.0.0.1" -keystore conf/server.keystore
+RUN /opt/keycloak/bin/kc.sh build
+
+FROM quay.io/keycloak/keycloak:26.0
+COPY --from=builder /opt/keycloak/ /opt/keycloak/
+
+# change these values to point to a running postgres instance
+ENV KC_DB=postgres
+ENV KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
+ENV KC_DB_USERNAME=keycloak
+ENV KC_DB_PASSWORD=keycloakpw
+ENV KC_HOSTNAME=id.boxi.ch
+ENV KC_HEALTH_ENABLED=true
+ENV KC_METRICS_ENABLED=true
+ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]