diff --git a/CHANGELOG.md b/CHANGELOG.md
index 221797e0f..b07b3bd61 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ## vNext
 
+### New and Improved
+
+* docker: Official Docker image for `hashicorp/boundary`
+  ([PR](https://github.com/hashicorp/boundary/pull/755))
+
 ### Bug Fixes
 
 * controller, worker: Fix IPv4-only check so `0.0.0.0` specified without a port
diff --git a/Makefile b/Makefile
index 585c0a157..ff7d1deac 100644
--- a/Makefile
+++ b/Makefile
@@ -149,7 +149,33 @@ test-ci: install-go
 install-go:
 	./ci/goinstall.sh
 
-.PHONY: api tools gen migrations proto website ci-config ci-verify set-ui-version
+# Docker build and publish variables and targets
+REGISTRY_NAME?=docker.io/hashicorp
+IMAGE_NAME=boundary
+VERSION?=0.1.1
+IMAGE_TAG=$(REGISTRY_NAME)/$(IMAGE_NAME):$(VERSION)
+IMAGE_TAG_DEV=$(REGISTRY_NAME)/$(IMAGE_NAME):latest-$(shell git rev-parse --short HEAD)
+DOCKER_DIR=./docker
+
+docker: docker-build docker-publish
+
+# builds from releases.hashicorp.com official binary
+docker-build:
+	docker build -t $(IMAGE_TAG) \
+	--build-arg VERSION=$(VERSION) \
+	-f $(DOCKER_DIR)/Release.dockerfile docker/ 
+
+# builds from locally generated binary in bin/
+docker-build-dev: export XC_OSARCH=linux/amd64
+docker-build-dev: dev
+	docker build -t $(IMAGE_TAG_DEV) \
+	-f $(DOCKER_DIR)/Dev.dockerfile .
+
+# requires appropriate permissions in dockerhub
+docker-publish:
+	docker push $(IMAGE_TAG)
+
+.PHONY: api tools gen migrations proto website ci-config ci-verify set-ui-version docker docker-build docker-build-dev docker-publish 
 
 .NOTPARALLEL:
 
diff --git a/docker/Dev.dockerfile b/docker/Dev.dockerfile
new file mode 100644
index 000000000..f44593e96
--- /dev/null
+++ b/docker/Dev.dockerfile
@@ -0,0 +1,17 @@
+FROM docker.mirror.hashicorp.services/alpine:3.10
+
+RUN addgroup boundary && \
+    adduser -S -G boundary boundary
+
+ADD bin/boundary /bin/boundary
+
+RUN mkdir /boundary/
+ADD docker/config.hcl /boundary/config.hcl
+RUN chown -R boundary:boundary /boundary/ 
+
+EXPOSE 9200 9201 9202
+VOLUME /boundary/
+
+USER boundary
+ENTRYPOINT ["/bin/boundary"]
+CMD ["server", "-config", "/boundary/config.hcl"]
diff --git a/docker/README.md b/docker/README.md
new file mode 100644
index 000000000..1759751ee
--- /dev/null
+++ b/docker/README.md
@@ -0,0 +1,88 @@
+# Boundary Docker Image
+
+This directory contains the officially supported HashiCorp Dockerfile to build the hashicorp/boundary docker image.
+
+## Build
+
+See the Makefile targets in the root of this repository for building and publishing this image in either
+development or release modes:
+
+  - `make docker-build-dev`
+  - `make docker-build`
+  - `make docker`
+
+## Usage
+
+### Dev Mode
+
+Due to the limitations of `boundary dev` running and maintaining a postgres docker container, it's not recommended
+to run `dev` mode inside docker. To do so will require knowledge of running [docker-in-docker](https://hub.docker.com/_/docker), and the caveats
+associated with it. 
+
+### Default Configuration
+
+The default behavior of the Boundary docker image is to run `boundary server -config /boundary/config.hcl`. The default
+configuration can be found in this directory and it's highly recommended that end users replace this configuration 
+with one that suites their environment. 
+
+### Postgres
+
+The usage instructions in this README assume you have an external postgres database (version 11 or greater) to run 
+boundary server with. If you want to get started quickly, you can start a local postgres in docker:
+
+```bash
+docker run -it -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres
+```
+
+The postgres URL setting is defined with `env://BOUNDARY_POSTGRES_URL` so it can be easily overidden with `-e`
+during docker run:
+
+```bash
+docker run <truncated> -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' <truncated>
+```
+### Database Init
+
+If you're starting with a new, unused postgres instance, initialize the database using the default config.hcl:
+
+```bash
+docker run \
+  --network host \
+  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  boundary database init -config /boundary/config.hcl
+```
+
+If you want to run this with your own config.hcl (assuming config.hcl is located at `$(pwd)/config.hcl`):
+
+```bash
+docker run \
+  --network host \
+  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  -v "$(pwd)":/boundary/ \
+  boundary database init -config /boundary/config.hcl
+```
+
+### Server
+Start a Boundary server using the default `config.hcl`:
+
+```bash
+docker run \
+  --network host \
+  -p 9200:9200 \
+  -p 9201:9201 \
+  -p 9202:9202 \
+  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  boundary
+```
+
+Start a Boundary server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:
+
+```bash
+docker run \
+  --network host \
+  -p 9200:9200 \
+  -p 9201:9201 \
+  -p 9202:9202 \
+  -v "$(pwd)":/boundary/ \
+  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  boundary
+```
diff --git a/docker/Release.dockerfile b/docker/Release.dockerfile
new file mode 100644
index 000000000..63cc4f1e9
--- /dev/null
+++ b/docker/Release.dockerfile
@@ -0,0 +1,46 @@
+FROM docker.mirror.hashicorp.services/alpine:3.10
+
+ARG VERSION=0.1.1
+
+LABEL name="Boundary" \
+      maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
+      vendor="HashiCorp" \
+      version=$VERSION \
+      release=$VERSION \
+      summary="Boundary provides simple and secure access to hosts and services" \
+      description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler"
+
+RUN addgroup boundary && \
+    adduser -s /bin/sh -S -G boundary boundary
+
+ADD https://releases.hashicorp.com/boundary/${VERSION}/boundary_${VERSION}_linux_amd64.zip /tmp/
+ADD https://releases.hashicorp.com/boundary/${VERSION}/boundary_${VERSION}_SHA256SUMS /tmp/
+ADD https://releases.hashicorp.com/boundary/${VERSION}/boundary_${VERSION}_SHA256SUMS.sig /tmp/ 
+
+RUN apk add --no-cache ca-certificates gnupg openssl libcap su-exec dumb-init tzdata 
+RUN cd /tmp/ && \
+    BUILD_GPGKEY=91A6E7F85D05C65630BEF18951852D87348FFC4C; \
+    found=''; \
+    for server in \
+        hkp://p80.pool.sks-keyservers.net:80 \
+        hkp://keyserver.ubuntu.com:80 \
+        hkp://pgp.mit.edu:80 \
+    ; do \
+        echo "Fetching GPG key $BUILD_GPGKEY from $server"; \
+        gpg --keyserver "$server" --recv-keys "$BUILD_GPGKEY" && found=yes && break; \
+    done; \
+    test -z "$found" && echo >&2 "error: failed to fetch GPG key $BUILD_GPGKEY" && exit 1; \
+    gpg --batch --verify boundary_${VERSION}_SHA256SUMS.sig boundary_${VERSION}_SHA256SUMS && \
+    grep boundary_${VERSION}_linux_amd64.zip boundary_${VERSION}_SHA256SUMS | sha256sum -c && \
+    unzip -d /bin boundary_${VERSION}_linux_amd64.zip
+
+RUN mkdir /boundary/
+ADD config.hcl /boundary/config.hcl
+RUN chown -R boundary:boundary /boundary/ 
+
+EXPOSE 9200 9201 9202
+VOLUME /boundary/
+
+USER boundary
+ENTRYPOINT ["/bin/boundary"]
+CMD ["server", "-config", "/boundary/config.hcl"]
diff --git a/docker/config.hcl b/docker/config.hcl
new file mode 100644
index 000000000..64df50ba9
--- /dev/null
+++ b/docker/config.hcl
@@ -0,0 +1,66 @@
+disable_mlock = true
+
+controller {
+  name = "demo-controller-1"
+  description = "A controller for a demo!"
+
+  database {
+    url = "env://BOUNDARY_POSTGRES_URL"
+    #url = "postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable"
+  }
+}
+
+worker {
+  name = "demo-worker-1"
+  description = "A default worker created demonstration"
+  controllers = [
+    "0.0.0.0",
+  ]
+  address = "0.0.0.0"
+}
+
+listener "tcp" {
+  address = "0.0.0.0"
+  purpose = "api"
+  tls_disable = true 
+}
+
+listener "tcp" {
+  address = "0.0.0.0"
+  purpose = "cluster"
+  tls_disable   = true 
+}
+
+listener "tcp" {
+  address       = "0.0.0.0"
+  purpose       = "proxy"
+  tls_disable   = true 
+}
+
+# Root KMS configuration block: this is the root key for Boundary
+# Use a production KMS such as AWS KMS in production installs
+kms "aead" {
+  purpose = "root"
+  aead_type = "aes-gcm"
+  key = "uC8zAQ3sLJ9o0ZlH5lWIgxNZrNn0FiFqYj4802VKLKQ="
+  key_id = "global_root"
+}
+
+# Worker authorization KMS
+# Use a production KMS such as AWS KMS for production installs
+# This key is the same key used in the worker configuration
+kms "aead" {
+  purpose = "worker-auth"
+  aead_type = "aes-gcm"
+  key = "cOQ9fiszFoxu/c20HbxRQ5E9dyDM6PqMY1GwqVLihsI="
+  key_id = "global_worker-auth"
+}
+
+# Recovery KMS block: configures the recovery key for Boundary
+# Use a production KMS such as AWS KMS for production installs
+kms "aead" {
+  purpose = "recovery"
+  aead_type = "aes-gcm"
+  key = "nIRSASgoP91KmaEcg/EAaM4iAkksyB+Lkes0gzrLIRM="
+  key_id = "global_recovery"
+}
diff --git a/scripts/uigen.sh b/scripts/uigen.sh
index 1c9847166..9a4371738 100755
--- a/scripts/uigen.sh
+++ b/scripts/uigen.sh
@@ -13,8 +13,7 @@ fi
 (
 	cd "$UI_CLONE_DIR"
 	if ! docker-compose -f docker-compose-embedding.yml run build; then
-		echo "==> UI build failed."
-		exit 1
+		yarn install && yarn build
 	fi
 )