diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fec24b7a7c9a7f97a1d2d3604393cada2967c887..29144715f7b1afbcb723fe5a58d07df89e79680d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -85,6 +85,21 @@ frontend-build:
   script:
     - npm run production
 
+docker-build:
+  stage: build
+  image: docker:20.10
+  services:
+    - docker:dind
+
+  # Needed to avoid triggering global npm ci
+  before_script:
+    - ''
+  except:
+    - schedules
+
+  script:
+    - ci/build.sh
+
 frontend-deploy:
   image: python:3-alpine
   stage: deploy
diff --git a/ci/build.sh b/ci/build.sh
new file mode 100755
index 0000000000000000000000000000000000000000..861b3ea6d9f567f2649748d1215f46855e558982
--- /dev/null
+++ b/ci/build.sh
@@ -0,0 +1,28 @@
+#!/bin/sh -e
+# Build and publish a Docker image.
+# Requires CI_PROJECT_DIR and CI_REGISTRY_IMAGE to be set.
+# VERSION defaults to latest.
+# Will only push an image if the commit is on the main branch or if a tag is defined.
+# Will automatically login to a registry if CI_REGISTRY, CI_REGISTRY_USER and CI_REGISTRY_PASSWORD are set.
+
+VERSION=${CI_COMMIT_TAG:-latest}
+
+if [ -z "$VERSION" -o -z "$CI_PROJECT_DIR" -o -z "$CI_REGISTRY_IMAGE" ]; then
+    echo Missing environment variables to build the image…
+    exit 1
+fi
+
+docker build $CI_PROJECT_DIR -f $CI_PROJECT_DIR/Dockerfile -t "$CI_REGISTRY_IMAGE:$VERSION"
+
+# Publish the image on the main branch or on a tag
+if [ "$CI_COMMIT_REF_NAME" = "master" -o -n "$CI_COMMIT_TAG" ]; then
+  if [ -n "$CI_REGISTRY" -a -n "$CI_REGISTRY_USER" -a -n "$CI_REGISTRY_PASSWORD" ]; then
+    echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
+    docker push "$CI_REGISTRY_IMAGE:$VERSION"
+  else
+    echo "Missing environment variables to log in to the container registry…"
+    exit 1
+  fi
+else
+  echo "The build was not published to the repository registry (only for main branch or tags)…"
+fi