diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..724bfa8
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,49 @@
+# General
+.DS_Store
+__MACOSX/
+.AppleDouble
+.LSOverride
+Icon[
+]
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+# VSCode
+
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+!.vscode/*.code-snippets
+!*.code-workspace
+
+# Built Visual Studio Code Extensions
+*.vsix
+
+# compiled go binaries
+/bin/*
+
+# keep gitkeep files
+!.gitkeep
+
+# env files
+.env*
+!.env.template
diff --git a/Containerfile b/Containerfile
index bfa239b..454012f 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,7 +1,9 @@
+# syntax=docker/dockerfile:1
 ARG GOARCH=amd64
 ARG GOOS=linux
 ARG CGO_ENABLED=0
 ARG BUILD_TIME=unknown
+ARG VERSION=unknown
 ARG SERVICE
 
 # Stage 1: Build
@@ -10,8 +12,8 @@ FROM docker.io/golang:1.24-alpine AS build
 ARG GOOS
 ARG GOARCH
 ARG CGO_ENABLED
-ARG VERSION
 ARG BUILD_TIME
+ARG VERSION
 ARG SERVICE
 
 WORKDIR /src
@@ -29,34 +31,29 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
     GOOS=${GOOS} \
     GOARCH=${GOARCH} \
     go build -trimpath \
-    -ldflags="-s -w -X 'main.BuildTime=${BUILD_TIME}'" \
-    -o /bin/${SERVICE} ./cmd/${SERVICE}
+      -ldflags "-s -w -X main.BuildTime=${BUILD_TIME} -X main.Version=${VERSION}" \
+      -o /out/${SERVICE} ./cmd/${SERVICE} && \
+    chmod +x /out/${SERVICE}
 
 # Stage 2: Runtime
-FROM docker.io/alpine:3.22 AS runtime
+FROM gcr.io/distroless/static-debian13:latest AS runtime
 
-ARG VERSION
 ARG BUILD_TIME
+ARG VERSION
 ARG SERVICE
 
-RUN addgroup -S app && adduser -S -G app app
-
 WORKDIR /app
 
-COPY --from=build /bin/${SERVICE} /app/bin
-
-RUN chown app:app /app/bin && chmod +x /app/bin
-
-USER app
+COPY --from=build --chown=1000:1000 /out/${SERVICE} /app/bin/${SERVICE}
 
 EXPOSE 8080 50051
 
-HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
-    CMD wget -qO- --timeout=2 http://127.0.0.1:8080/health || exit 1
+LABEL org.opencontainers.image.created="${BUILD_TIME}" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.title="${SERVICE}"
 
-LABEL org.opencontainers.image.version=${VERSION}
-LABEL org.opencontainers.image.created=${BUILD_TIME}
+USER 1000
 
-ENTRYPOINT ["/app/bin"]
+ENTRYPOINT ["/app/bin/${SERVICE}"]
 
-CMD [""]
+CMD []