diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index b9e760c..856d3b5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -15,7 +15,7 @@ permissions:
   contents: read
   deployments: none
   issues: none
-  packages: none
+  packages: write
   pull-requests: none
   repository-projects: none
   security-events: none
@@ -166,6 +166,7 @@ jobs:
 
   build:
     runs-on: ubuntu-20.04
+    if: github.ref != 'refs/heads/main'
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
@@ -173,3 +174,28 @@ jobs:
           go-version: "~1.20"
       - name: build image
         run: make -j build/image/envbox
+  publish:
+    runs-on: ubuntu-20.04
+    if: github.ref == 'refs/heads/main'
+    steps:
+      - name: Docker Login
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v3
+        with:
+          go-version: "~1.20"
+
+      - name: build image
+        run: make -j build/image/envbox
+
+      - name: tag image
+        run: docker tag envbox ghcr.io/coder/envbox:latest
+
+      - name: push image
+        run: docker push ghcr.io/coder/envbox:latest
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index fbba263..c81d6be 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -4,6 +4,12 @@ FROM ubuntu:focal
 # Copy configuration files to appropriate locations
 COPY files /
 
+LABEL \
+  org.opencontainers.image.title="Envbox" \
+  org.opencontainers.image.url="https://github.com/coder/envbox" \
+  org.opencontainers.image.source="https://github.com/coder/envbox" \
+  org.opencontainers.image.description="Run Docker in Docker in Kubernetes"
+
 # Basic utilities
 ARG DEBIAN_FRONTEND=noninteractive
 #   Ignore other repositories, as some require HTTPS