diff --git a/.github/workflows/build-all.yml b/.github/workflows/build-all.yml
new file mode 100644
index 0000000..1a819ac
--- /dev/null
+++ b/.github/workflows/build-all.yml
@@ -0,0 +1,81 @@
+name: Build zapret
+on:
+  push:
+    paths:
+      - 'ip2net/**'
+      - 'mdig/**'
+      - 'nfq/**'
+      - 'tpws/**'
+  pull_request:
+    paths:
+      - 'ip2net/**'
+      - 'mdig/**'
+      - 'nfq/**'
+      - 'tpws/**'
+  workflow_dispatch:
+
+env:
+  DOCKER_BUILD_SUMMARY: false
+
+jobs:
+  build:
+    name: Build for Linux
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        arch:
+          - aarch64-musl
+          - arm-musleabi
+          - arm-musleabihf
+          - mipsel-musl
+          - i586-musl
+          - x86_64-musl
+    # container:
+    #   image: messense/rust-musl-cross:${{ matrix.arch }}
+    #   options: --user root
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Docker in tmpfs
+        run: |
+          sudo systemctl stop docker
+          sudo mount -t tmpfs -o size=80% tmpfs /var/lib/docker
+          sudo systemctl start docker
+
+      - name: Cache Docker images
+        id: docker-cache
+        uses: ScribeMD/docker-cache@0.5.0
+        with:
+          key: docker-${{ runner.os }}-${{ matrix.arch }}
+
+      # - name: Set up Docker Buildx
+      #   if: steps.docker-cache.outputs.cache-hit != 'true'
+      #   uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker image
+        if: steps.docker-cache.outputs.cache-hit != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          tags: zapret-musl-cross:${{ matrix.arch }}
+          context: .
+          load: true
+          build-args: BUILDARCH=${{ matrix.arch }}
+          # cache-from: type=gha
+          # cache-to: type=gha,mode=max
+
+      - name: Compile zapret
+        run: |
+          docker run --entrypoint=bash -v ${{ github.workspace }}:/work \
+          zapret-musl-cross:${{ matrix.arch }} \
+          -c 'cd /work; CC=$TARGET_CC CFLAGS="-static" make -j$(nproc)'
+
+      - name: Declare short commit variable
+        id: vars
+        run: |
+          git config --global --add safe.directory '*' && echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+
+      - name: Upload output file
+        uses: actions/upload-artifact@v4
+        with:
+          name: zapret_${{ steps.vars.outputs.sha_short }}_${{ matrix.arch }}
+          path: binaries/my/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7ea9566
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,43 @@
+ARG BUILDARCH=x86_64-musl
+
+FROM messense/rust-musl-cross:$BUILDARCH
+
+RUN <<'EOF'
+    set -eu
+    export PKG_CONFIG_PATH=$TARGET_HOME/lib/pkgconfig/
+    export CC=$TARGET_CC
+
+    mkdir /root/extlibs
+    cd /root/extlibs
+
+    apt update
+    apt install --no-install-recommends -y wget libtool pkg-config libcap-dev
+
+    wget https://www.zlib.net/zlib-1.3.1.tar.gz
+    echo 9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23 zlib-1.3.1.tar.gz | sha256sum -c && tar axf zlib-1.3.1.tar.gz
+
+    git clone -b libnfnetlink-1.0.2 --depth 1 git://git.netfilter.org/libnfnetlink
+    git clone -b libnetfilter_queue-1.0.5 --depth 1 git://git.netfilter.org/libnetfilter_queue
+    git clone -b libmnl-1.0.5 --depth 1 git://git.netfilter.org/libmnl
+
+    (
+        cd zlib-*
+        ./configure --static
+        make -j$(nproc)
+        make install
+    )
+
+    for i in libnfnetlink libmnl libnetfilter_queue; do
+        (
+            echo COMPILING $i
+            cd $i
+            ./autogen.sh
+            ./configure --host=${TARGET_CC%-gcc} --prefix=$TARGET_HOME --enable-static
+            make -j$(nproc)
+            make install
+        )
+    done
+
+    cp /usr/include/sys/capability.h ${TARGET_HOME}/include/sys/
+    cp /usr/include/x86_64-linux-gnu/sys/queue.h ${TARGET_HOME}/include/sys/
+EOF