diff --git a/prototypes/quic_demo/.gitignore b/prototypes/quic_demo/.gitignore
index 5c8950b..1892ca7 100644
--- a/prototypes/quic_demo/.gitignore
+++ b/prototypes/quic_demo/.gitignore
@@ -1,2 +1,4 @@
 # TLS certs used for QUIC experiments
 *.crt
+
+/app_packages
diff --git a/prototypes/quic_demo/Dockerfile b/prototypes/quic_demo/Dockerfile
new file mode 100644
index 0000000..930db77
--- /dev/null
+++ b/prototypes/quic_demo/Dockerfile
@@ -0,0 +1,81 @@
+# https://whitfin.io/speeding-up-rust-docker-builds/
+# TODO: https://stackoverflow.com/questions/57389547/how-to-define-the-context-for-a-docker-build-as-a-specific-commit-on-one-of-the
+
+# rust:1.50-slim-buster
+FROM rust@sha256:5dd85eb0c60bbdea14a6ecba1f6fe4a0f5c878bcf06d2cdfae0aff3a19ed4b10 as build
+
+WORKDIR /
+ENV USER root
+
+# create empty shell projects
+RUN cargo new --bin ptth
+
+WORKDIR /ptth
+
+RUN \
+cargo new --lib crates/always_equal && \
+cargo new --lib crates/ptth_core && \
+cargo new --bin crates/ptth_relay && \
+cargo new --bin crates/ptth_server && \
+cargo new --bin crates/ptth_file_server_bin && \
+cargo new --bin tools/ptth_tail && \
+cargo new --bin crates/debug_proxy && \
+cargo new --bin prototypes/quic_demo
+
+# copy over your manifests
+COPY ./Cargo.lock                               ./
+COPY ./Cargo.toml                               ./
+COPY ./crates/always_equal/Cargo.toml           ./crates/always_equal/
+COPY ./crates/ptth_core/Cargo.toml              ./crates/ptth_core/
+COPY ./crates/ptth_relay/Cargo.toml             ./crates/ptth_relay/
+COPY ./prototypes/quic_demo/Cargo.toml          ./prototypes/quic_demo/
+
+# this build step will cache your dependencies
+RUN cargo build --release -p quic_demo
+
+RUN \
+rm \
+src/*.rs \
+crates/always_equal/src/*.rs \
+crates/ptth_core/src/*.rs \
+crates/ptth_relay/src/*.rs \
+prototypes/quic_demo/src/*.rs
+
+# Copy source tree
+# Yes, I tried a few variations on the syntax. Dockerfiles are just rough.
+
+COPY ./src/                 ./src
+COPY ./crates/always_equal  ./crates/always_equal
+COPY ./crates/ptth_core     ./crates/ptth_core
+COPY ./crates/ptth_relay    ./crates/ptth_relay
+COPY ./handlebars/          ./handlebars
+COPY ./prototypes/quic_demo ./prototypes/quic_demo
+
+# Bug in cargo's incremental build logic, triggered by
+# Docker doing something funny with mtimes? Maybe?
+RUN touch crates/ptth_core/src/lib.rs
+
+# build for release
+# gate only on ptth_relay tests for now
+RUN \
+cargo build --release -p quic_demo --bin quic_demo_relay_server && \
+cargo test --release -p quic_demo --bin quic_demo_relay_server
+
+# debian:buster-slim
+FROM debian@sha256:13f0764262a064b2dd9f8a828bbaab29bdb1a1a0ac6adc8610a0a5f37e514955
+
+RUN apt-get update \
+&& apt-get upgrade -y \
+&& apt-get install -y libssl1.1 ca-certificates tini
+
+RUN addgroup --gid 10001 ptth_user && adduser --system --uid 10000 --gid 10001 ptth_user
+
+USER ptth_user
+WORKDIR /home/ptth_user
+
+COPY --from=build /ptth/target/release/quic_demo_relay_server ./
+
+ARG git_version
+RUN echo -n "$git_version" > ./git_version.txt
+
+CMD ["/usr/bin/tini", "--", "./quic_demo_relay_server"]
diff --git a/prototypes/quic_demo/build_app_package.bash b/prototypes/quic_demo/build_app_package.bash
new file mode 100755
index 0000000..bf4bce0
--- /dev/null
+++ b/prototypes/quic_demo/build_app_package.bash
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+GIT_COMMIT=$(git rev-parse main)
+GIT_COMMIT_SHORT=$(echo "$GIT_COMMIT" | cut -b -8)
+DOCKER_TAG="ptth_quic:latest"
+
+mkdir -p app_packages
+
+pushd ../../
+git archive --format=tar "$GIT_COMMIT" | sudo docker build -f prototypes/quic_demo/Dockerfile -t "$DOCKER_TAG" --build-arg "git_version=$GIT_COMMIT" -
+popd
+
+sudo docker run --rm "$DOCKER_TAG" tar -c \
+quic_demo_relay_server \
+| gzip > "app_packages/ptth_relay_$GIT_COMMIT_SHORT.tar.gz"
+
+sudo docker build -f app_package_Dockerfile -t ptth_app_host:latest .