diff --git a/.forgejo/workflows/publish-faceai-container.yml b/.forgejo/workflows/publish-faceai-container.yml
new file mode 100644
index 00000000..0f637f6d
--- /dev/null
+++ b/.forgejo/workflows/publish-faceai-container.yml
@@ -0,0 +1,118 @@
+name: Publish FaceAI Container
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - faceai/**
+      - .forgejo/workflows/publish-faceai-container.yml
+  workflow_dispatch:
+
+env:
+  REGISTRY: ${{ vars.FORGEJO_REGISTRY }}
+  IMAGE_NAMESPACE: ${{ vars.IMAGE_NAMESPACE }}
+  IMAGE_NAME: ${{ vars.IMAGE_NAME != '' && vars.IMAGE_NAME || 'faceai' }}
+  BUILD_CONTEXT: faceai
+  DOCKERFILE_PATH: faceai/docker/Dockerfile
+
+jobs:
+  publish:
+    runs-on: docker
+    env:
+      DOCKER_HOST: ${{ vars.DOCKER_HOST != '' && vars.DOCKER_HOST || 'tcp://172.17.0.1:2375' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate workflow variables
+        run: |
+          set -eu
+          if [ -z "${REGISTRY}" ]; then echo "vars.FORGEJO_REGISTRY is required"; exit 1; fi
+          if [ -z "${IMAGE_NAMESPACE}" ]; then echo "vars.IMAGE_NAMESPACE is required"; exit 1; fi
+          if [ -z "${IMAGE_NAME}" ]; then echo "vars.IMAGE_NAME resolved to an empty value"; exit 1; fi
+          if [ ! -f "${DOCKERFILE_PATH}" ]; then echo "Dockerfile not found at ${DOCKERFILE_PATH}"; exit 1; fi
+          if [ ! -f "${BUILD_CONTEXT}/package.json" ]; then echo "Build context is invalid: ${BUILD_CONTEXT}"; exit 1; fi
+
+      - name: Validate registry secrets
+        run: |
+          set -eu
+          if [ -z "${{ secrets.FORGEJO_REGISTRY_USERNAME }}" ]; then echo "secrets.FORGEJO_REGISTRY_USERNAME is required"; exit 1; fi
+          if [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then echo "secrets.FORGEJO_REGISTRY_TOKEN is required"; exit 1; fi
+
+      - name: Ensure Docker CLI exists
+        run: |
+          set -eu
+          if command -v docker >/dev/null 2>&1; then
+            docker --version
+            exit 0
+          fi
+
+          ARCH="$(uname -m)"
+          case "${ARCH}" in
+            x86_64) DOCKER_ARCH="x86_64" ;;
+            aarch64|arm64) DOCKER_ARCH="aarch64" ;;
+            *) echo "Unsupported architecture for Docker CLI bootstrap: ${ARCH}"; exit 1 ;;
+          esac
+
+          DOCKER_CLI_VERSION="27.5.1"
+          curl -fsSL "https://download.docker.com/linux/static/stable/${DOCKER_ARCH}/docker-${DOCKER_CLI_VERSION}.tgz" -o docker.tgz
+          tar -xzf docker.tgz
+          mkdir -p "${HOME}/.local/bin"
+          mv docker/docker "${HOME}/.local/bin/docker"
+          chmod +x "${HOME}/.local/bin/docker"
+          echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
+          "${HOME}/.local/bin/docker" --version
+
+      - name: Ensure Docker Buildx exists
+        run: |
+          set -eu
+          if docker buildx version >/dev/null 2>&1; then
+            docker buildx version
+            exit 0
+          fi
+
+          ARCH="$(uname -m)"
+          case "${ARCH}" in
+            x86_64) BUILDX_ARCH="amd64" ;;
+            aarch64|arm64) BUILDX_ARCH="arm64" ;;
+            *) echo "Unsupported architecture for Docker Buildx bootstrap: ${ARCH}"; exit 1 ;;
+          esac
+
+          BUILDX_VERSION="v0.21.1"
+          mkdir -p "${HOME}/.docker/cli-plugins"
+          curl -fsSL "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-${BUILDX_ARCH}" -o "${HOME}/.docker/cli-plugins/docker-buildx"
+          chmod +x "${HOME}/.docker/cli-plugins/docker-buildx"
+          docker buildx version
+
+      - name: Check Docker daemon connectivity
+        run: |
+          set -eu
+          echo "Using DOCKER_HOST=${DOCKER_HOST}"
+          docker version
+          docker info >/dev/null
+
+      - name: Create Buildx builder
+        run: |
+          set -eu
+          docker buildx rm forgejo-builder >/dev/null 2>&1 || true
+          docker buildx create --name forgejo-builder --driver docker-container --use
+          docker buildx inspect --bootstrap
+
+      - name: Login to Forgejo registry
+        run: |
+          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${REGISTRY}" -u "${{ secrets.FORGEJO_REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build and push image
+        run: |
+          set -eu
+          IMAGE_REF="${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}"
+          SHORT_SHA="$(echo "${GITHUB_SHA}" | cut -c1-12)"
+          docker buildx build \
+            --builder forgejo-builder \
+            --file "${DOCKERFILE_PATH}" \
+            --tag "${IMAGE_REF}:sha-${SHORT_SHA}" \
+            --tag "${IMAGE_REF}:latest" \
+            --push \
+            "${BUILD_CONTEXT}"
\ No newline at end of file