diff --git a/Dockerfile b/Dockerfile
index 420fd7f..e500f5d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,4 @@
 from golang:1.25-alpine as builder
-env KNOT_REPO_SCAN_PATH=/home/git/repositories
 env CGO_ENABLED=1
 
 arg TAG='v1.11.0-alpha'
@@ -7,9 +6,15 @@ arg TAG='v1.11.0-alpha'
 workdir /app
 run apk add git gcc musl-dev
 run git clone -b ${TAG} https://tangled.org/@tangled.org/core .
-run go build -o /usr/bin/knot -ldflags '-s -w -extldflags "-static"' ./cmd/knot
 
-from alpine:latest
+FROM builder AS build-knot
+RUN go build -o /usr/bin/knot -ldflags '-s -w -extldflags "-static"' ./cmd/knot
+
+FROM builder AS build-spindle
+RUN go build -o /usr/bin/spindle ./cmd/spindle
+
+from alpine:latest AS knot
+ENV KNOT_REPO_SCAN_PATH=/home/git/repositories
 expose 5555
 expose 22
 
@@ -31,10 +36,34 @@ run groupadd -g $GID -f git
 run useradd -u $UID -g $GID -d /home/git git
 run openssl rand -hex 16 | passwd --stdin git
 run mkdir -p /home/git/repositories && chown -R git:git /home/git
-copy --from=builder /usr/bin/knot /usr/bin
+copy --from=build-knot /usr/bin/knot /usr/bin
 run mkdir /app && chown -R git:git /app
 
 healthcheck --interval=60s --timeout=30s --start-period=5s --retries=3 \
     cmd curl -f http://localhost:5555 || exit 1
-
 entrypoint ["/init"]
+
+FROM alpine:edge AS spindle
+EXPOSE 6555
+
+LABEL org.opencontainers.image.title="spindle"
+LABEL org.opencontainers.image.description="ci server for tangled"
+LABEL org.opencontainers.image.source="https://tangled.org/@tangled.org/knot-docker"
+LABEL org.opencontainers.image.url="https://tangled.org"
+LABEL org.opencontainers.image.vendor="tangled.org"
+LABEL org.opencontainers.image.licenses="MIT"
+
+ARG UID=1000
+ARG GID=1000
+
+RUN groupadd --system -g $GID -f spindle
+RUN useradd --system -u $UID -g $GID spindle
+RUN mkdir -p /app && chown -R spindle:spindle /app
+
+COPY --from=build-spindle /usr/bin/spindle /usr/bin
+
+WORKDIR /app
+CMD ["spindle"]
+VOLUME ["/app"]
+HEALTHCHECK --interval=60s --timeout=30s --start-period=5s --retries=3 \
+    CMD curl -f http://localhost:6555 || exit 1