diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
new file mode 100644
index 0000000..70bbfc3
--- /dev/null
+++ b/.gitea/workflows/container.yml
@@ -0,0 +1,51 @@
+name: Test, Build and Push Container Image
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+concurrency:
+  group: container-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  REGISTRY: git.felixfoertsch.de
+  IMAGE: felixfoertsch/ios-advanced-parental-controls
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test backend
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install -r backend/requirements-dev.txt
+          .venv/bin/pytest -c backend/pyproject.toml backend/tests
+
+      - name: Check dashboard JavaScript
+        run: node --check backend/src/apc/static/app.js
+
+      - name: Log in to Gitea Container Registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u "${{ github.actor }}" --password-stdin
+
+      - name: Build and push image
+        run: |
+          docker buildx create --use --name ci-builder --driver docker-container || docker buildx use ci-builder
+          docker buildx build \
+            --platform linux/amd64 \
+            --push \
+            --cache-from "type=registry,ref=$REGISTRY/$IMAGE:buildcache" \
+            --cache-to "type=registry,ref=$REGISTRY/$IMAGE:buildcache,mode=max" \
+            -t "$REGISTRY/$IMAGE:latest" \
+            -t "$REGISTRY/$IMAGE:sha-${GITHUB_SHA}" \
+            .
+
+      - name: Prune local BuildKit cache
+        if: always()
+        run: |
+          if docker buildx use ci-builder; then
+            docker buildx prune --builder ci-builder --all --force --max-used-space 10gb
+          fi
diff --git a/deploy/unraid/advanced-parental-controls.xml b/deploy/unraid/advanced-parental-controls.xml
new file mode 100644
index 0000000..b6a038d
--- /dev/null
+++ b/deploy/unraid/advanced-parental-controls.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Container version="2">
+	<Name>Advanced-Parental-Controls</Name>
+	<Repository>git.felixfoertsch.de/felixfoertsch/ios-advanced-parental-controls:latest</Repository>
+	<Registry>https://git.felixfoertsch.de/felixfoertsch/-/packages/container/ios-advanced-parental-controls/latest</Registry>
+	<Network>traefik</Network>
+	<Shell>sh</Shell>
+	<Privileged>false</Privileged>
+	<Support>https://git.felixfoertsch.de/felixfoertsch/ios-advanced-parental-controls</Support>
+	<Project>https://git.felixfoertsch.de/felixfoertsch/ios-advanced-parental-controls</Project>
+	<Overview>Self-hosted policy, pairing, reward, and parent dashboard service for Family Quests.</Overview>
+	<Category>Productivity:</Category>
+	<WebUI>https://apc.felixfoertsch.de/</WebUI>
+	<Icon/>
+	<ExtraParams>--read-only --tmpfs /tmp:rw,noexec,nosuid,size=64m --cap-drop=ALL --security-opt=no-new-privileges --restart=unless-stopped</ExtraParams>
+	<PostArgs/>
+	<CPUset/>
+	<DateInstalled/>
+	<DonateText/>
+	<DonateLink/>
+	<Description>Advanced Parental Controls stores SQLite state under /data and exposes its HTTP service on port 8000 to the Traefik network.</Description>
+	<Config Name="Data" Target="/data" Default="/mnt/user/appdata/advanced-parental-controls/" Mode="rw" Description="Persistent SQLite database" Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/advanced-parental-controls/</Config>
+	<Config Name="APC_ADMIN_TOKEN" Target="APC_ADMIN_TOKEN" Default="" Mode="" Description="Random administration token with at least 32 characters" Type="Variable" Display="always" Required="true" Mask="true"></Config>
+	<Config Name="APC_ORIGIN" Target="APC_ORIGIN" Default="https://apc.felixfoertsch.de" Mode="" Description="Exact HTTPS origin used by the parent dashboard" Type="Variable" Display="always" Required="true" Mask="false">https://apc.felixfoertsch.de</Config>
+</Container>