diff --git a/Dockerfile b/Dockerfile
index 6d58b50..a2e4863 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,23 +1,28 @@
-FROM rust:1.68-buster as builder
-
-RUN apt-get update && \
-    apt-get install -y libssl-dev pkg-config
+FROM rust:alpine AS builder
+RUN apk add --no-cache openssl-dev musl-dev
+RUN rustup target add x86_64-unknown-linux-musl
 
 WORKDIR /srv
 
 # Build dependencies and cache them
 COPY Cargo.* ./
-RUN mkdir -p src && \
-    echo "fn main() {println!(\"if you see this, the build broke\")}" > src/main.rs && \
-    cargo build --release && \
-    rm -r src && \
-    rm target/release/deps/tricot*
 
 # Build final app
 COPY ./src ./src
-RUN cargo build --release
+RUN RUSTFLAGS=-Ctarget-feature=-crt-static \
+  cargo build \
+    --release \
+    --target=x86_64-unknown-linux-musl
 
-FROM debian:bullseye-slim
-RUN apt-get update && apt-get install -y libssl1.1 iptables ca-certificates
-COPY --from=builder /srv/target/release/tricot /usr/local/sbin/tricot
-CMD ["/usr/local/sbin/tricot"]
+RUN objcopy \
+  --compress-debug-sections \
+  target/x86_64-unknown-linux-musl/release/tricot \
+  target/x86_64-unknown-linux-musl/release/tricot.compressed
+
+FROM alpine
+RUN apk add -U --no-cache ca-certificates libgcc
+COPY --from=builder \
+  /srv/target/x86_64-unknown-linux-musl/release/tricot.compressed \
+  /usr/local/bin/tricot
+
+CMD ["/usr/local/bin/tricot"]