diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1a0d5f3..e84f7d2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -49,7 +49,7 @@ jobs:
       - uses: Swatinem/rust-cache@v1
       - uses: lriesebos/nix-develop-command@6f5f4830884d1957767e920c51d6118c9b0ac828
         with:
-          command: "cargo clippy -D warnings"
+          command: "cargo clippy -- -D warnings"
 
   build:
     name: Build
@@ -62,4 +62,21 @@ jobs:
           name: ci
           instance: https://cache.icewind.me
           authToken: '${{ secrets.ATTIC_TOKEN }}'
-      - run: nix build .#${{ matrix.target }}
\ No newline at end of file
+      - run: nix build .#${{ matrix.target }}
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v20
+      - uses: icewind1991/attic-action@v1
+        with:
+          name: ci
+          instance: https://cache.icewind.me
+          authToken: '${{ secrets.ATTIC_TOKEN }}'
+      - run: nix build .#dockerImage
+      - name: Push image
+        if: github.ref == 'refs/heads/main'
+        run: |
+          skopeo copy --dest-creds="${{ secrets.DOCKERHUB_USERNAME }}:${{ secrets.DOCKERHUB_TOKEN }}" "docker-archive:$(nix build .#dockerImage --print-out-paths)" "docker://demostf/backup"
\ No newline at end of file
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
deleted file mode 100644
index 316ed7a..0000000
--- a/.github/workflows/docker.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: docker-build
-
-on:
-  push:
-    branches:
-      - 'main'
-      - 'master'
-
-jobs:
-  docker:
-    runs-on: ubuntu-20.04
-    steps:
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Login to DockerHub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Build and push
-        id: docker_build
-        uses: docker/build-push-action@v2
-        with:
-          push: true
-          tags: demostf/backup:latest
-      - name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}
\ No newline at end of file
diff --git a/flake.nix b/flake.nix
index 7c1abbd..2ffa10f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,12 +11,23 @@
       system: let
         pkgs = nixpkgs.legacyPackages."${system}";
         naersk-lib = naersk.lib."${system}";
+        lib = pkgs.lib;
       in
         rec {
           # `nix build`
-          packages.demobackup = naersk-lib.buildPackage {
-            pname = "demobackup";
-            root = ./.;
+          packages = rec {
+            demobackup = naersk-lib.buildPackage {
+              pname = "demobackup";
+              root = lib.sources.sourceByRegex (lib.cleanSource ./.) ["Cargo.*" "src" "src/.*"];
+            };
+            dockerImage = pkgs.dockerTools.buildImage {
+              name = "demostf/backup";
+              tag = "latest";
+              copyToRoot = [demobackup];
+              config = {
+                Cmd = [ "${demobackup}/bin/backup"];
+              };
+            };
           };
           defaultPackage = packages.demobackup;