diff --git a/Dockerfile b/Dockerfile
index 5861e3d..88a66c1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1 +1,9 @@
-FROM nginx:latest
+FROM golang:1.19 as builder
+WORKDIR /app
+COPY . .
+RUN go build -o ./bin ./cmd/...
+
+FROM ubuntu:22.04
+COPY --from=builder /app/bin/themis-server /usr/local/bin/themis-server
+RUN apt update -y; apt install -y ca-certificates; apt-get clean
+ENTRYPOINT ["themis-server", "-db=prod.db"]
\ No newline at end of file
diff --git a/cmd/themis-server/main.go b/cmd/themis-server/main.go
index aac7e4d..95248c4 100644
--- a/cmd/themis-server/main.go
+++ b/cmd/themis-server/main.go
@@ -6,6 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"log"
+	"net/http"
 	"os"
 	"os/signal"
 	"strconv"
@@ -216,6 +217,14 @@ func main() {
 	}
 
 	log.Printf("registered %d commands\n", len(registeredCommands))
+
+	go func() {
+		if err := serve(":8080"); err != nil {
+			log.Printf("[error]: %s\n", err)
+		}
+		cancel()
+	}()
+
 	<-ctx.Done()
 
 	for _, c := range registeredCommands {
@@ -285,3 +294,12 @@ func formatClaimsTable(claims []themis.Claim) string {
 	}
 	return sb.String()
 }
+
+func serve(address string) error {
+	http.Handle("/health", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("OK"))
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	return http.ListenAndServe(address, nil)
+}
diff --git a/fly.toml b/fly.toml
index 854bbf1..8300501 100644
--- a/fly.toml
+++ b/fly.toml
@@ -3,7 +3,9 @@
 app = "themis"
 kill_signal = "SIGINT"
 kill_timeout = 5
-processes = []
+
+[processes]
+themis = "/usr/local/bin/themis-server"
 
 [env]
 
@@ -13,8 +15,8 @@ processes = []
 
 [[services]]
   http_checks = []
-  internal_port = 80
-  processes = ["app"]
+  internal_port = 8080
+  processes = ["themis"]
   protocol = "tcp"
   script_checks = []
   [services.concurrency]