diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..304be82
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,11 @@
+stages:
+  - build
+
+build:
+  stage: build
+  image:
+    name: gcr.io/kaniko-project/executor:debug
+    entrypoint: [""]
+  script:
+    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
+    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA --destination $CI_REGISTRY_IMAGE:latest
diff --git a/.woodpecker.yml b/.woodpecker.yml
new file mode 100644
index 0000000..67ce884
--- /dev/null
+++ b/.woodpecker.yml
@@ -0,0 +1,22 @@
+pipeline:
+  publish:
+    image: plugins/docker
+    registry: registry.nulo.in
+    repo: registry.nulo.in/sutty/syncthing
+    tags:
+    - ${ALPINE_VERSION}
+    - latest
+    build_args:
+    - ALPINE_VERSION=${ALPINE_VERSION}
+    - BASE_IMAGE=registry.nulo.in/sutty/monit
+    username: sutty
+    secrets:
+    - docker_password
+    when:
+      branch: antifascista
+      event: push
+
+matrix:
+  ALPINE_VERSION:
+  - 3.13.6
+  - 3.14.2
diff --git a/Dockerfile b/Dockerfile
index 891cf18..ede5bc2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,16 @@
-FROM alpine:latest AS build
+ARG ALPINE_VERSION=3.13.6
+ARG BASE_IMAGE=sutty/monit
+FROM ${BASE_IMAGE}:${ALPINE_VERSION}
 MAINTAINER "f <f@sutty.nl>"
 
 COPY ./syncthing_start.sh /usr/local/bin/syncthing_start
 RUN chmod 755 /usr/local/bin/syncthing_start
 
-FROM sutty/monit:latest
+FROM ${BASE_IMAGE}:${ALPINE_VERSION}
+ARG ALPINE_VERSION
 
-# Syncthing runs with the same uid and gid for Sutty so ownership is
-# kept, since ST doesn't sync these.
+# Syncthing runs with Sutty's uid and gid so ownership is kept, because
+# they are not synced.
 RUN addgroup -g 82 -S syncthing
 RUN adduser -s /bin/sh -G syncthing -D -u 1000 -h /home/syncthing syncthing