diff --git a/Dockerfile b/Dockerfile
index 127125740..03a75032c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,30 @@
-FROM alpine as alpine
-RUN apk add -U --no-cache ca-certificates
+FROM golang:1.18.3-alpine3.16@sha256:7cc62574fcf9c5fb87ad42a9789d5539a6a085971d58ee75dd2ee146cb8a8695 AS build
 
-FROM scratch
-COPY --from=alpine /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-ENTRYPOINT ["/dnscontrol"]
-COPY dnscontrol /
+WORKDIR /go/src/github.com/StackExchange/dnscontrol
+
+ARG BUILD_VERSION
+
+ENV GO111MODULE on
+
+COPY . .
+
+# build dnscontrol
+RUN apk update \
+    && apk add --no-cache ca-certificates curl gcc build-base git \
+    && update-ca-certificates \
+    && go build -v -trimpath -buildmode=pie -ldflags="-s -w -X main.SHA=${BUILD_VERSION}"
+
+# Validation check
+RUN cp dnscontrol /go/bin/dnscontrol
+RUN dnscontrol version
+
+# -----
+
+FROM alpine:3.16.0@sha256:686d8c9dfa6f3ccfc8230bc3178d23f84eeaf7e457f36f271ab1acc53015037c
+
+COPY --from=build /etc/ssl/certs /etc/ssl/certs
+COPY --from=build /go/bin/dnscontrol /usr/local/bin
+
+WORKDIR /dns
+
+ENTRYPOINT ["/usr/local/bin/dnscontrol"]