diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 0000000..b120dbb
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,45 @@
+def resolveImageTag(env) {
+    return env.TAG_NAME?.replace(env.RELEASE_TAG_PREFIX, '') ?: 'latest'
+}
+
+def resolveImageName(env) {
+    return "${env.REGISTRY_HOST}/docker-base-images/${env.IMAGE_BASE_NAME}:${resolveImageTag(env)}"
+}
+
+pipeline {
+    agent {
+        docker {
+            image 'git.tswf.io/docker-base-images/alpine-base:1.0.0-3.17.3'
+            // Mount docker socket for docker-in-docker
+            args '-v /var/run/docker.sock:/var/run/docker.sock'
+        }
+    }
+    stages {
+        stage('prepare') {
+            steps {
+                script {
+                    env.IMAGE_BASE_NAME = "jenkins-ssh-agent-jdk17-dind"
+                    env.RELEASE_TAG_PREFIX = "release-"
+                    env.REGISTRY_HOST = "git.tswf.io"
+                    if (env.TAG_NAME == null) {
+                        env.TAG_NAME = sh(returnStdout: true, script: "git tag --points-at HEAD").trim()
+                    }
+                }
+            }
+        }
+        stage('build_docker') {
+            steps {
+                sh "docker build . --tag ${resolveImageName(env)}"
+            }
+        }
+        stage('push_docker') {
+            when {
+                tag "${env.RELEASE_TAG_PREFIX}*"
+            }
+            steps {
+                sh "docker login ${env.REGISTRY_HOST} -u ${env.GITEA_USER} -p ${env.GITEA_OAUTH_TOKEN}"
+                sh "docker image push ${resolveImageName(env)}"
+            }
+        }
+    }
+}
\ No newline at end of file