diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..fdd32d0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,14 @@
+FROM mcr.microsoft.com/dotnet/sdk:7.0-alpine AS build
+WORKDIR /src
+COPY . ./
+WORKDIR Groceries
+RUN dotnet restore
+RUN dotnet publish --no-restore --output /out
+
+FROM mcr.microsoft.com/dotnet/aspnet:7.0-alpine AS base
+WORKDIR /groceries
+COPY --from=build /out .
+COPY --from=build /src/Groceries/config.ini /config/
+VOLUME /config
+ENV DOTNET_ENABLEDIAGNOSTICS=0
+ENTRYPOINT ["./Groceries", "--data", "/config"]
diff --git a/Groceries.sln b/Groceries.sln
index 5e1be9b..2716b92 100644
--- a/Groceries.sln
+++ b/Groceries.sln
@@ -11,6 +11,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
 	ProjectSection(SolutionItems) = preProject
 		.editorconfig = .editorconfig
 		.gitignore = .gitignore
+		Dockerfile = Dockerfile
 	EndProjectSection
 EndProject
 Global
diff --git a/Groceries/Groceries.csproj b/Groceries/Groceries.csproj
index 8d0f4cd..fa1bb8e 100644
--- a/Groceries/Groceries.csproj
+++ b/Groceries/Groceries.csproj
@@ -6,6 +6,9 @@
         <Nullable>enable</Nullable>
         <WarningsAsErrors>nullable</WarningsAsErrors>
         <AnalysisMode>recommended</AnalysisMode>
+
+        <PublishRelease>true</PublishRelease>
+        <SatelliteResourceLanguages>en</SatelliteResourceLanguages>
     </PropertyGroup>
 
     <ItemGroup>
@@ -18,8 +21,4 @@
         <ProjectReference Include="..\Groceries.Data\Groceries.Data.csproj" />
     </ItemGroup>
 
-    <ItemGroup>
-        <None Update="config.ini" CopyToOutputDirectory="PreserveNewest" />
-    </ItemGroup>
-
 </Project>
diff --git a/Groceries/Program.cs b/Groceries/Program.cs
index 00bf397..17f2ebd 100644
--- a/Groceries/Program.cs
+++ b/Groceries/Program.cs
@@ -1,14 +1,24 @@
 using Groceries.Common;
 using Groceries.Data;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Mvc.Infrastructure;
 using Microsoft.AspNetCore.Mvc.Razor;
 using Microsoft.EntityFrameworkCore;
 
 var builder = WebApplication.CreateBuilder(args);
+var env = builder.Environment;
+
+var dataDir = builder.Configuration.GetValue<string>("data") ?? env.ContentRootPath;
 
 builder.Configuration
-    .AddIniFile("config.ini", optional: true, reloadOnChange: true)
-    .AddIniFile($"config_{builder.Environment.EnvironmentName}.ini", optional: true, reloadOnChange: true);
+    .AddIniFile(Path.Combine(dataDir, "config.ini"), optional: true, reloadOnChange: true)
+    .AddIniFile(Path.Combine(dataDir, $"config_{env.EnvironmentName}.ini"), optional: true, reloadOnChange: true);
+
+var dataProtection = builder.Services.AddDataProtection();
+if (env.IsProduction())
+{
+    dataProtection.PersistKeysToFileSystem(new DirectoryInfo(Path.Combine(dataDir, "keys")));
+}
 
 var mvc = builder.Services
     .AddControllersWithViews()
@@ -20,7 +30,7 @@ var mvc = builder.Services
     })
     .AddSessionStateTempDataProvider();
 
-if (builder.Environment.IsDevelopment())
+if (env.IsDevelopment())
 {
     mvc.AddRazorRuntimeCompilation();
 }
@@ -31,8 +41,8 @@ builder.Services.AddSession();
 builder.Services.AddSingleton<IActionResultExecutor<TurboStreamResult>, TurboStreamResultExecutor>();
 
 builder.Services.AddDbContextPool<AppDbContext>(options => options
-    .EnableDetailedErrors(builder.Environment.IsDevelopment())
-    .EnableSensitiveDataLogging(builder.Environment.IsDevelopment())
+    .EnableDetailedErrors(env.IsDevelopment())
+    .EnableSensitiveDataLogging(env.IsDevelopment())
     .UseQueryTrackingBehavior(QueryTrackingBehavior.NoTracking)
     .UseSnakeCaseNamingConvention()
     .UseNpgsql(builder.Configuration["Database"]!));