diff --git a/README.md b/README.md
index 4b34de6..80942c5 100644
--- a/README.md
+++ b/README.md
@@ -24,14 +24,22 @@ PDS_JWT_SECRET=$(cargo run -- secret) cargo run -- serve
 ```
 
 Or as the container, which is how a server that is not this one gets run.
-Nothing is published yet, so the image is still built here:
+`compose.yaml` holds the same thing for `docker compose up -d`:
 
 ```sh
-docker build --tag manapds .
-docker run --rm manapds secret
-docker run --env-file pds.env --volume manapds:/data --publish 2583:2583 manapds
+docker run --rm ghcr.io/eth0net/manapds:edge secret
+docker run --env-file pds.env --volume manapds:/data --publish 2583:2583 \
+  ghcr.io/eth0net/manapds:edge
 ```
 
+Images are `linux/amd64` and `linux/arm64`. `edge` is the tip of main, which is
+the only tag there is until the first release; after that a release is
+`X.Y.Z`, `X.Y` and `latest`, and only those three are worth pinning. Nothing
+updates itself — [watchtower's fork](https://github.com/nicholas-fedor/watchtower)
+or [diun](https://github.com/crazy-max/diun) will do it or tell you about it,
+and following `X.Y` is the point at which that is a safe thing to leave running
+overnight.
+
 Configuration is environment variables under the same names the reference
 server uses, so an existing `pds.env` works unedited. The secret sessions are
 signed under is the one variable with no default, since inventing one at each
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..a3fab57
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,19 @@
+# A server, and nothing else. TLS belongs to whatever sits in front: the
+# hostname has to answer HTTPS on a real certificate before any client will
+# resolve a handle here.
+services:
+  manapds:
+    container_name: manapds
+    image: ghcr.io/eth0net/manapds:edge
+    restart: unless-stopped
+    ports:
+      - "2583:2583"
+    volumes:
+      - manapds:/data
+    # Named for the reference server's file, since the variables are the same
+    # and an existing one starts this.
+    env_file:
+      - pds.env
+
+volumes:
+  manapds: