diff --git a/.dockerignore b/.dockerignore
index 202b2c8f..e602e335 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,8 @@
+.git
 *.o
 *.so
 *.dylib
+*.bc
 .depend
 Dockerfile
+third_party/duckdb/build
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
new file mode 100644
index 00000000..8b64f948
--- /dev/null
+++ b/.github/workflows/docker.yaml
@@ -0,0 +1,48 @@
+name: Build Docker
+
+on:
+  push:
+     tags: ["v*"]
+     branches: ['main']
+  pull_request:
+    paths:
+      - Dockerfile
+      - docker-bake.hcl
+      - '.github/workflows/docker.yaml'
+
+jobs:
+  docker:
+    name: Build Docker
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        postgres: ["16", "17"]
+
+    steps:
+      -
+        name: setup POSTGRES_IMAGE env
+        run: echo "POSTGRES_IMAGE=${{ format('wuputah/pg_duckdb:{0}-{1}', matrix.postgres, github.sha) }}" >> $GITHUB_ENV
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up Docker buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          platforms: linux/amd64,linux/arm64
+      # -
+      #   name: Login to DockerHub
+      #   uses: docker/login-action@v3
+      #   with:
+      #     username: ${{ secrets.DOCKERHUB_USERNAME }}
+      #     password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: docker bake
+        uses: docker/bake-action@v5
+        with:
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/Dockerfile b/Dockerfile
index 0f9e9492..c96e78e5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM postgres:16-bookworm AS base
+FROM postgres_base AS base
 
 ###
 ### BUILDER
@@ -7,9 +7,13 @@ FROM base AS builder
 
 RUN --mount=type=cache,target=/var/cache/apt \
   apt-get update -qq && \
-  apt-get install -y build-essential libreadline-dev zlib1g-dev flex bison libxml2-dev libxslt-dev \
-  libssl-dev libxml2-utils xsltproc pkg-config libc++-dev libc++abi-dev libglib2.0-dev libtinfo5 cmake \
-  libstdc++-12-dev postgresql-server-dev-16 liblz4-dev ccache
+  for pkg in \
+    build-essential libreadline-dev zlib1g-dev flex bison libxml2-dev libxslt-dev \
+    libssl-dev libxml2-utils xsltproc pkg-config libc++-dev libc++abi-dev libglib2.0-dev \
+    libtinfo5 cmake libstdc++-12-dev postgresql-server-dev-16 liblz4-dev ccache; \
+  do \
+      apt-get install -y $pkg; \
+  done
 
 WORKDIR /build
 
@@ -20,7 +24,7 @@ ENV CCACHE_DIR=/ccache
 # Instead, use .dockerignore to not copy files here.
 COPY . .
 
-RUN make clean
+RUN make clean-all
 
 # permissions so we can run as `postgres` (uid=999,gid=999)
 RUN mkdir /out
diff --git a/docker-bake.hcl b/docker-bake.hcl
new file mode 100644
index 00000000..2c3ee697
--- /dev/null
+++ b/docker-bake.hcl
@@ -0,0 +1,57 @@
+variable "REPO" {
+  # temp repo on dockerhub
+  default = "wuputah/pg_duckdb"
+}
+
+variable "POSTGRES_VERSION" {
+  default = "16"
+}
+
+target "shared" {
+  platforms = [
+    "linux/amd64",
+    "linux/arm64"
+  ]
+}
+
+target "postgres" {
+  inherits = ["shared"]
+
+  contexts = {
+    // pg_duckdb = "target:pg_duckdb_${POSTGRES_VERSION}"
+    postgres_base = "docker-image://postgres:${POSTGRES_VERSION}-bookworm"
+  }
+
+  args = {
+    POSTGRES_VERSION = "${POSTGRES_VERSION}"
+  }
+
+  tags = [
+    "${REPO}:${POSTGRES_VERSION}",
+  ]
+}
+
+target "pg_duckdb" {
+  inherits = ["postgres"]
+  target = "output"
+}
+
+target "pg_duckdb_16" {
+  inherits = ["pg_duckdb"]
+
+  args = {
+    POSTGRES_VERSION = 16
+  }
+}
+
+target "pg_duckdb_17" {
+  inherits = ["pg_duckdb"]
+
+  args = {
+    POSTGRES_VERSION = 17
+  }
+}
+
+target "default" {
+  inherits = ["pg_duckdb_16"]
+}