diff --git a/.github/workflows/build_env.yml b/.github/workflows/build_env.yml
new file mode 100644
index 000000000..d906d8102
--- /dev/null
+++ b/.github/workflows/build_env.yml
@@ -0,0 +1,17 @@
+name: Build CI Env Image
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  build_env:
+    name: Build
+    permissions:
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run build scripts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ci/build-env.sh
diff --git a/ci/Dockerfile b/ci/Dockerfile
new file mode 100644
index 000000000..f7d80ad45
--- /dev/null
+++ b/ci/Dockerfile
@@ -0,0 +1,67 @@
+FROM ubuntu:22.04 AS build-env
+
+ARG LIB_ROCKS_SYS_VER
+
+RUN apt-get update -y --force-yes && \
+    DEBIAN_FRONTEND=noninteractive \
+    apt-get install -y --force-yes make build-essential cmake curl pkg-config expect \
+    openssl libssl-dev lld wget unzip git bash zstd libzstd-dev clang \ 
+    etcd-client parallel && \
+    rm -rf /var/lib/{apt,dpkg,cache,log}/
+
+# *RUN* commands on bash
+SHELL ["/bin/bash", "-c"]
+
+WORKDIR /xline
+
+COPY rust-toolchain.toml rust-toolchain.toml
+
+ENV PATH=/root/.cargo/bin/:$PATH
+# Enable sparse index
+ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
+
+# Install stuff
+# The vast majority of the cache comes from rocksdb, so we choose to
+# precompile directly here to reduce the number of sccache cache hit checks.
+RUN echo "=== Install rusty stuff 🦀️ ===" && \
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- --no-modify-path --default-toolchain none -y && \
+    rustup component add rustfmt llvm-tools clippy && \
+    rustup show -v && \
+    curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash && \
+    cargo binstall -y --no-symlinks cargo-llvm-cov cargo-nextest cargo-hakari cargo-sort cargo-cache cargo-audit && \
+    cargo install --locked sccache && \
+    cargo cache --autoclean && \
+    rm -rf "/root/.cargo/registry/index" && \
+    rm -rf "/root/.cargo/registry/cache" && \
+    rm -rf "/root/.cargo/git/db" && \
+    cargo uninstall cargo-binstall cargo-cache && \
+    echo "=== Install Protoc ===" && \
+    wget https://github.com/protocolbuffers/protobuf/releases/download/v21.10/protoc-21.10-linux-x86_64.zip && \
+    unzip protoc-21.10-linux-x86_64.zip -d .local && \
+    mv ".local/bin/protoc" /bin/ && \
+    mv ".local/include/google" /usr/include/ && \
+    rm -rf .local/ protoc-21.10-linux-x86_64.zip && \
+    protoc --version && \
+    echo "=== Prebuilt rocksdb ===" && \
+    curl -L --proto '=https' --tlsv1.2 -sSf https://crates.io/api/v1/crates/librocksdb-sys/$LIB_ROCKS_SYS_VER/download | tar -zxf - && \
+    cd librocksdb-sys-$LIB_ROCKS_SYS_VER/rocksdb/ && \
+    make install && \
+    cd /xline && \
+    rm -rf librocksdb-sys-$LIB_ROCKS_SYS_VER/
+
+# Set some environments that librocksdb-sys will use them to skip building rocksdb
+ENV ROCKSDB_STATIC=1
+ENV ROCKSDB_INCLUDE_DIR=/usr/local/include
+ENV ROCKSDB_LIB_DIR=/usr/local/lib
+
+# No incremental build and debug info, which might cause slow build in CI
+# Refer to https://matklad.github.io/2021/09/04/fast-rust-builds.html#CI-Workflow
+ENV CARGO_INCREMENTAL=0
+ENV CARGO_PROFILE_DEV_DEBUG=0
+
+# Cargo something
+ENV CARGO_HOME=/xline/.cargo
+ENV CARGO_TERM_COLOR=always
+
+# Enable sccache
+ENV RUSTC_WRAPPER="sccache"
diff --git a/ci/build-env.sh b/ci/build-env.sh
new file mode 100755
index 000000000..e956014aa
--- /dev/null
+++ b/ci/build-env.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+cd "$DIR"
+
+echo "=== Toolchain ==="
+cat rust-toolchain.toml
+
+export DOCKER_BUILDKIT=1
+export GHCR_ORG=xline-kv
+export BUILD_TAG="ghcr.io/${GHCR_ORG}/build-env:latest"
+# Change this version if rust-rocksdb updates in `engine`
+export LIB_ROCKS_SYS_VER="0.11.0+8.1.1"
+
+echo "=== Arch ==="
+arch
+
+echo "=== Docker build ==="
+set -x
+
+docker build -t ${BUILD_TAG} --progress=plain --no-cache --build-arg LIB_ROCKS_SYS_VER=$LIB_ROCKS_SYS_VER .
+
+set +x
+
+echo "=== Docker login ==="
+echo -n $GITHUB_TOKEN | docker login --username $GHCR_ORG --password-stdin "ghcr.io/${GHCR_ORG}"
+
+echo "=== Docker push ==="
+docker push ${BUILD_TAG}
diff --git a/ci/rust-toolchain.toml b/ci/rust-toolchain.toml
new file mode 100644
index 000000000..aec8b305f
--- /dev/null
+++ b/ci/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "1.70.0"
+components = ["rustfmt", "clippy", "rust-src"]
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
deleted file mode 100644
index aec8b305f..000000000
--- a/rust-toolchain.toml
+++ /dev/null
@@ -1,3 +0,0 @@
-[toolchain]
-channel = "1.70.0"
-components = ["rustfmt", "clippy", "rust-src"]
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 120000
index 000000000..6d4f2df86
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1 @@
+ci/rust-toolchain.toml
\ No newline at end of file