diff --git a/.github/workflows/ghcr-push.yml b/.github/workflows/ghcr-push.yml
new file mode 100644
index 0000000..52511c6
--- /dev/null
+++ b/.github/workflows/ghcr-push.yml
@@ -0,0 +1,39 @@
+name: Deploy to GHCR
+
+# only run most recent workflow in branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches: [ "master" ]
+    paths:
+      - '**/*.dockerfile'
+
+jobs:
+  build-0.6.13:
+    name: Build + Publish 16
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+    - uses: actions/checkout@v4
+      name: Checkout
+
+    - name: Set Environment
+      run: |
+        echo "SLUG=ghcr.io/cwpearson/cmake-format-0.6.13" >> $GITHUB_ENV
+        echo "DATE=$(date +"%Y%m%d")" >> $GITHUB_ENV
+
+    - name: Build
+      run: |
+        docker build -f cmake-format-0.6.13.dockerfile -t "$SLUG:latest" -t "$SLUG:$DATE" .
+
+    - name: Publish to GHCR
+      run: |
+        echo '${{secrets.GHCR_TOKEN}}' | docker login ghcr.io -u cwpearson --password-stdin
+        docker push "$SLUG:latest"
+        docker push "$SLUG:$DATE"
diff --git a/README.md b/README.md
index 329b444..fdb86a6 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,23 @@
-# cmake-format
\ No newline at end of file
+# cmake-format
+
+## Quick Run
+
+```bash
+cd your/source/tree
+podman run --rm -v "${PWD}"/src ghcr.io/cwpearson/clang-format-16:latest clang-format ...
+```
+
+Inside the container, the working directory is /src, we use the volume mount to map the host working directory `${PWD}` into `/src`: `-v "${PWD}"/src`.
+
+## Building the Image Locally
+
+```bash
+podman build -f cmake-format-0.6.13.dockerfile -t cmake-format-0.6.13:latest
+podman run --rm -v "${PWD}"/src cmake-format-0.6.13:latest cmake-format ...
+```
+
+## Deploy
+
+1. Create a "personal access token (classic)" with `write:packages`
+  * account > settings > developer settings > personal access tokens
+2. Put that personal access token as the repository secret `GHCR_TOKEN`.
diff --git a/cmake-format-0.6.13.dockerfile b/cmake-format-0.6.13.dockerfile
new file mode 100644
index 0000000..e2dd218
--- /dev/null
+++ b/cmake-format-0.6.13.dockerfile
@@ -0,0 +1,19 @@
+# Stage 1: Build environment
+FROM docker.io/redhat/ubi8 AS builder
+
+LABEL maintainer="Carl Pearson <me@carlpearson.net>"
+LABEL org.opencontainers.image.title="cmake-format 0.6"
+LABEL description="A container with cmake-format 0.6"
+LABEL org.opencontainers.image.description="A container with cmake-format 0.6"
+LABEL org.opencontainers.image.source https://github.com/cwpearson/clang-format
+LABEL org.opencontainers.image.licenses="GPLv3"
+
+RUN dnf install -y \
+    python3 \
+    && dnf clean all
+
+ADD pip-install.sh .
+RUN /bin/bash pip-install.sh
+
+# expect caller to map $PWD into /src with -v flag
+WORKDIR /src
diff --git a/pip-install.sh b/pip-install.sh
new file mode 100644
index 0000000..50a8b4b
--- /dev/null
+++ b/pip-install.sh
@@ -0,0 +1,13 @@
+#! /bin/bash
+
+set -eou pipefail
+
+NEXUS_ROOT=https://nexus.web.sandia.gov/
+
+if curl --output /dev/null --silent --head --fail "$NEXUS_ROOT"; then
+  PIP_ARGS="--index-url=$NEXUS_ROOT/repository/pypi-proxy/simple"
+else
+  PIP_ARGS=""
+fi
+
+python3 -m pip install "$PIP_ARGS" cmakelang==0.6.13