diff --git a/default.nix b/default.nix
index f672e1c10..2abe2368e 100644
--- a/default.nix
+++ b/default.nix
@@ -81,6 +81,10 @@ rec {
   postgrestStatic =
     lib.justStaticExecutables (lib.dontCheck drvStatic);
 
+  # Docker image and loading script.
+  docker =
+    pkgs.callPackage nix/docker { postgrest = postgrestStatic; };
+
   # Environment in which PostgREST can be built with cabal, useful e.g. for
   # defining a shell for nix-shell.
   env =
diff --git a/nix/docker/default.nix b/nix/docker/default.nix
new file mode 100644
index 000000000..c96bb7de1
--- /dev/null
+++ b/nix/docker/default.nix
@@ -0,0 +1,63 @@
+{ postgrest, dockerTools, writeShellScriptBin }:
+let
+  image =
+    tag:
+      dockerTools.buildImage {
+        inherit tag;
+
+        name = "postgrest/postgrest";
+        contents = postgrest;
+
+        # Set the current time as the image creation date. This makes the build
+        # non-reproducible, but that should not be an issue for us.
+        created = "now";
+
+        extraCommands =
+          ''
+            mkdir etc
+            cp ${./postgrest.conf} etc/postgrest.conf
+          '';
+
+        config = {
+          Cmd = [ "/bin/postgrest" "/etc/postgrest.conf" ];
+          Env = [
+            "PGRST_DB_URI=postgresql://?user=postgres"
+            "PGRST_DB_SCHEMA=public"
+            "PGRST_DB_ANON_ROLE="
+            "PGRST_DB_POOL=100"
+            "PGRST_DB_EXTRA_SEARCH_PATH=public"
+            "PGRST_SERVER_HOST=*4"
+            "PGRST_SERVER_PORT=3000"
+            "PGRST_OPENAPI_SERVER_PROXY_URI="
+            "PGRST_JWT_SECRET="
+            "PGRST_SECRET_IS_BASE64=false"
+            "PGRST_JWT_AUD="
+            "PGRST_MAX_ROWS="
+            "PGRST_PRE_REQUEST="
+            "PGRST_ROLE_CLAIM_KEY=.role"
+            "PGRST_ROOT_SPEC="
+            "PGRST_RAW_MEDIA_TYPES="
+          ];
+          User = "1000";
+          ExposedPorts = {
+            "3000/tcp" = {};
+          };
+        };
+      };
+in
+rec {
+  imageLatest =
+    image "latest";
+
+  imageWithVersion =
+    image "v${postgrest.version}";
+
+  load =
+    writeShellScriptBin "postgrest-docker-load"
+      ''
+        set -euo pipefail
+
+        docker load -i ${imageLatest}
+        docker load -i ${imageWithVersion}
+      '';
+}
diff --git a/nix/docker/postgrest.conf b/nix/docker/postgrest.conf
new file mode 100644
index 000000000..c1b5b9bd7
--- /dev/null
+++ b/nix/docker/postgrest.conf
@@ -0,0 +1,19 @@
+db-uri = "$(PGRST_DB_URI)"
+db-schema = "$(PGRST_DB_SCHEMA)"
+db-anon-role = "$(PGRST_DB_ANON_ROLE)"
+db-pool = "$(PGRST_DB_POOL)"
+db-extra-search-path = "$(PGRST_DB_EXTRA_SEARCH_PATH)"
+
+server-host = "$(PGRST_SERVER_HOST)"
+server-port = "$(PGRST_SERVER_PORT)"
+
+openapi-server-proxy-uri = "$(PGRST_OPENAPI_SERVER_PROXY_URI)"
+jwt-secret = "$(PGRST_JWT_SECRET)"
+secret-is-base64 = "$(PGRST_SECRET_IS_BASE64)"
+jwt-aud = "$(PGRST_JWT_AUD)"
+role-claim-key = "$(PGRST_ROLE_CLAIM_KEY)"
+
+max-rows = "$(PGRST_MAX_ROWS)"
+pre-request = "$(PGRST_PRE_REQUEST)"
+root-spec = "$(PGRST_ROOT_SPEC)"
+raw-media-types = "$(PGRST_RAW_MEDIA_TYPES)"