diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..d616c8c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1 @@
+xsum
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..68c9179
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,17 @@
+FROM golang:1.13 as builder
+
+WORKDIR /go/src/github.com/sneak/xsum
+COPY . .
+
+RUN go get -v && make build
+
+# this container doesn't do anything except hold the build artifact
+# and make sure it compiles.
+
+FROM alpine
+
+COPY --from=builder /go/src/github.com/sneak/xsum/xsum /bin/xsum
+
+CMD /bin/xsum
+
+# FIXME add testing
diff --git a/Makefile b/Makefile
index 4fbdb05..9280944 100644
--- a/Makefile
+++ b/Makefile
@@ -20,8 +20,11 @@ run: build
 
 build: ./xsum
 
-./xsum: *.go */*.go
+./xsum: *.go
 	go build -o $@ $(GOFLAGS) .
 
 fmt:
 	go fmt *.go
+
+test:
+	docker build -t sneak/xsum .
diff --git a/README.md b/README.md
index d55bccf..2c5603f 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,11 @@ You can dd a few random bytes into the middle of an hfs+ or apfs filesystem,
 and, if they land in file data, an fsck/Disk First Aid on the filesystem
 will pass with flying colors.  There is no file content checksum.
 
+# todo
+
+* recurse into directories
+* more parallelism
+
 # author
 
 Jeffrey Paul [sneak@sneak.berlin](mailto:sneak@sneak.berlin)