diff --git a/substrate/.gitlab-ci.yml b/substrate/.gitlab-ci.yml
index c87cdae7c3..60e2f491a1 100644
--- a/substrate/.gitlab-ci.yml
+++ b/substrate/.gitlab-ci.yml
@@ -1,59 +1,63 @@
+# .gitlab-ci.yml
+#
 stages:
   - test
   - build
+  - publish
 
 image:                             parity/rust:nightly
 
 variables:
   CI_SERVER_NAME:                  "GitLab CI"
-  CARGO_HOME:                      "${CI_PROJECT_DIR}/cargo"
+  CARGO_HOME:                      "${CI_PROJECT_DIR}/.cargo"
 
-  BUILD_TARGET:                    ubuntu
-  BUILD_ARCH:                      amd64
-  CARGO_TARGET:                    x86_64-unknown-linux-gnu
 
-.releaseable_branches:             # list of git refs for building GitLab artifacts (think "pre-release binaries")
-  only:                            &releaseable_branches
-    - master
-    - stable
-    - beta
-    - tags
-    - gitlab-next
 
-.publishable_branches:             # list of git refs for publishing builds to the "production" locations
-  only:                            &publishable_branches
-    - nightly # Our nightly builds from schedule, on `master`
-    - "v*" # Our version tags
-    - gitlab-next
+cache:
+  key:                             "${CI_JOB_NAME}"
+  paths:
+    - ./.cargo/
+
 
 .collect_artifacts:                &collect_artifacts
   artifacts:
     name:                          "${CI_JOB_NAME}_${CI_COMMIT_REF_NAME}"
     when:                          on_success
-    expire_in:                     1 mos
+    expire_in:                     7 days
     paths:
-    - target/release/substrate
+    - target/release/
 
-.determine_version: &determine_version |
-  export VERSION=$(grep -m 1 "version =" Cargo.toml | awk '{print $3}' | tr -d '"' | tr -d "\n")
-  echo "Version" $VERSION
+
+# not needed atm
+# .determine_version: &determine_version |
+#   export VERSION="$(sed -r -n '1,/^version/s/^version = "([^"]+)".*$/\1/p' Cargo.toml)";
+#   echo "Version = " $VERSION
+
+before_script:
+ - ./scripts/build.sh
 
 
 #### stage:                        test
 
+
 test:rust:stable:                  &test
   stage:                           test
   variables:
     RUST_TOOLCHAIN: stable
     TARGET: native
-  script:
-    - ./scripts/init.sh
-    - export PATH="${CI_PROJECT_DIR}/cargo/bin/:$PATH"
-    - export RUST_BACKTRACE=1
-    - ./scripts/build.sh
-    - time cargo test --all --release --locked
+  only:
+    - triggers
+    - tags
+    - master
+    - schedules
+    - web
+    - /^pr-[0-9]+$/
+    - /^[0-9]+$/
+
   tags:
-    - rust-stable
+    - linux-docker
+  script:
+    - time cargo test --all --release --verbose --locked
 
 .optional_test:                    &optional_test
   <<:                              *test
@@ -61,21 +65,62 @@ test:rust:stable:                  &test
   only:
     - master
 
+
+
+
 #### stage:                        build
 
-build:linux:ubuntu:amd64:          &build
+build:rust:linux:release:          &build
   stage:                           build
-  only:                            *releaseable_branches
-  variables:
-    CARGO_TARGET:                  x86_64-unknown-linux-gnu
-    TARGET:                        native
-    RUST_TOOLCHAIN:                stable
-  script:
-    - ./scripts/init.sh
-    - export PATH="${CI_PROJECT_DIR}/cargo/bin/:$PATH"
-    - ./scripts/build.sh
-    - cargo build --release
   <<:                              *collect_artifacts
+  only:
+    - master
+    - tags
+    - web
   tags:
-    - rust-stable
-  allow_failure: true
+    - linux-docker
+  script:
+    - time cargo build --release --verbose;
+    - ./target/release/substrate --version
+    - sha256sum ./target/release/substrate
+
+
+
+
+
+#### stage:                        publish
+
+publish:docker:release:
+  stage:                           publish
+  dependencies:
+    - build:rust:linux:release
+  cache: {}
+  only:
+    - master
+    - tags
+    - web
+  tags:
+    - shell
+  variables:
+    DOCKERFILE: scripts/docker/Dockerfile
+    CONTAINER_IMAGE: parity/substrate
+  before_script:
+    - test "$Docker_Hub_User_Parity" -a "$Docker_Hub_Pass_Parity"
+        || ( echo "no docker credentials provided"; exit 1 )
+    - docker login -u "$Docker_Hub_User_Parity" -p "$Docker_Hub_Pass_Parity"
+    - docker info
+    - VERSION="$(./target/release/substrate --version | sed -n -r 's/^substrate ([0-9.]+-.*-[0-9a-f]{8})-.*$/\1/p')"
+    - export VERSION
+    - echo "Substrate version = ${VERSION}"
+  script:
+    # - CONTAINER_TAG="${CI_COMMIT_TAG:-latest}"
+    # - docker build --tag $CONTAINER_IMAGE:$CI_BUILD_REF --tag $CONTAINER_IMAGE:$CONTAINER_TAG -f $DOCKERFILE ./target/release/
+    # - docker push $CONTAINER_IMAGE:$CONTAINER_TAG
+    - test -z "${VERSION}" && exit 1
+    - docker build --tag $CONTAINER_IMAGE:$VERSION --tag $CONTAINER_IMAGE:latest -f $DOCKERFILE ./target/release/
+    - docker push $CONTAINER_IMAGE:$VERSION
+    - docker push $CONTAINER_IMAGE:latest
+  after_script:
+    - docker logout
+
+
diff --git a/substrate/scripts/docker/Dockerfile b/substrate/scripts/docker/Dockerfile
new file mode 100644
index 0000000000..3511ef2b7d
--- /dev/null
+++ b/substrate/scripts/docker/Dockerfile
@@ -0,0 +1,29 @@
+FROM ubuntu:xenial
+LABEL maintainer "devops-team@parity.io"
+LABEL description="Substrate: The platform for blockchain innovators"
+
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y \
+		libssl1.0.0 \
+		ca-certificates \
+		curl && \
+    apt-get autoremove -y && \
+    apt-get clean
+    
+RUN	find /var/lib/apt/lists/ -type f -not -name lock -delete
+
+COPY ./substrate /usr/local/bin
+
+
+
+RUN useradd -m -u 1000 -U -s /bin/sh -d /substrate substrate
+USER substrate
+
+ENV RUST_BACKTRACE 1
+
+EXPOSE 30333 9933 9944
+VOLUME ["/substrate"]
+
+ENTRYPOINT ["/usr/local/bin/substrate"]
+