diff --git a/runner/Dockerfile b/runner/Dockerfile
new file mode 100644
index 00000000..188e3a93
--- /dev/null
+++ b/runner/Dockerfile
@@ -0,0 +1,17 @@
+FROM ubuntu:18.04
+
+RUN apt update \
+  && apt install curl ca-certificates expect -y --no-install-recommends \
+  && adduser --disabled-password --gecos "" --uid 1001 runner
+
+RUN mkdir -p /runner \
+  && cd /runner \
+  && curl -O -L https://github.com/actions/runner/releases/download/v2.165.0/actions-runner-linux-x64-2.165.0.tar.gz \
+  && tar xzf ./actions-runner-linux-x64-2.165.0.tar.gz \
+  && rm actions-runner-linux-x64-2.165.0.tar.gz \
+  && ./bin/installdependencies.sh
+
+COPY entrypoint.sh /runner
+
+USER runner:runner
+ENTRYPOINT ["/runner/entrypoint.sh"]
diff --git a/runner/entrypoint.sh b/runner/entrypoint.sh
new file mode 100755
index 00000000..008dbfbc
--- /dev/null
+++ b/runner/entrypoint.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+if [ -z "${RUNNER_NAME}" ]; then
+  echo "RUNNER_NAME must be set" 1>&2
+  exit 1
+fi
+
+if [ -z "${RUNNER_REPO}" ]; then
+  echo "RUNNER_REPO must be set" 1>&2
+  exit 1
+fi
+
+if [ -z "${RUNNER_TOKEN}" ]; then
+  echo "RUNNER_TOKEN must be set" 1>&2
+  exit 1
+fi
+
+cd /runner
+./config.sh --unattended --replace --name "${RUNNER_NAME}" --url "https://github.com/${RUNNER_REPO}" --token "${RUNNER_TOKEN}"
+./run.sh