diff --git a/default.nix b/default.nix
new file mode 100644
index 0000000..ea13f34
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,28 @@
+# { system ? builtins.currentSystem }:
+{ sources ? import ./nix/sources.nix
+, pkgs ? import sources.nixpkgs { }
+, callPackage ? pkgs.callPackage
+}:
+
+let
+  cargoNix = callPackage ./Cargo.nix { };
+
+  hoc = cargoNix.rootCrate.build;
+
+  buildInputs = [ pkgs.openssl pkgs.cacert ];
+
+  # version = hoc.version;
+
+# in hoc.rootCrate.build
+in
+pkgs.symlinkJoin {
+  name = hoc.name;
+  version = hoc.crateVersion;
+  paths = [ hoc ];
+
+  buildInputs = [ pkgs.openssl pkgs.cacert ];
+
+  postBuild = ''
+    rm -rf $out/bin/hoc.d
+  '';
+}
diff --git a/docker.nix b/docker.nix
new file mode 100644
index 0000000..d8af2d8
--- /dev/null
+++ b/docker.nix
@@ -0,0 +1,24 @@
+# { system ? builtins.currentSystem }:
+
+let
+  # pkgs = import <nixpkgs> { inherit system; };
+  pkgs = import <nixpkgs> { };
+
+  callPackage = pkgs.lib.callPackageWith pkgs;
+
+  hoc = callPackage ./default.nix { };
+
+  dockerImage = pkg:
+    pkgs.dockerTools.buildImage {
+      name = "vbrandl/hits-of-code";
+      tag = hoc.version;
+
+      contents = [ pkg ];
+
+      config = {
+        Cmd = [ "/bin/hoc" ];
+        WorkingDir = "/";
+      };
+    };
+
+in dockerImage hoc