diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 7b19e39..a4fdbbf 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -13,46 +13,54 @@ env:
 jobs:
   test:
     name: Test
-    runs-on: rust
-    container: rust:1-bookworm
+    runs-on: docker
+    container:
+      image: rust:1.81-bookworm
     steps:
-      - name: Install node (required by JS-based actions)
-        run: apt-get update && apt-get install -y --no-install-recommends nodejs
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - uses: actions/checkout@v4
-
-      - name: Cache cargo
+      - name: Cache cargo registry
         uses: actions/cache@v4
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+          path: ~/.cargo/registry
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            cargo-${{ runner.os }}-
+            cargo-registry-
+
+      - name: Cache cargo index
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/git
+          key: cargo-git-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-git-
+
+      - name: Cache build target
+        uses: actions/cache@v4
+        with:
+          path: target
+          key: cargo-target-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            cargo-target-
 
       - name: Run tests
-        run: cargo test --all
+        run: cargo test --all --verbose
+
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+      - name: Run clippy
+        run: cargo clippy --all -- -D warnings
 
   build:
-    name: Build and push image
-    runs-on: golang
+    name: Build and Push Image
+    runs-on: docker
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    container:
-      image: docker:27-cli
-      volumes:
-        - /docker-certs/client:/docker-certs/client:ro
-    env:
-      DOCKER_HOST: tcp://localhost:2376
-      DOCKER_TLS_VERIFY: "1"
-      DOCKER_CERT_PATH: /docker-certs/client
     steps:
-      - name: Install node (required by JS-based actions)
-        run: apk add --no-cache nodejs git
-
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
 
       - name: Get short SHA
         id: sha
@@ -60,21 +68,23 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Registry login
-        run: |
-          echo "${REGISTRY_PAT}" | docker login "${REGISTRY}" \
-            --username rock --password-stdin
-        env:
-          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: rock
+          password: ${{ secrets.REGISTRY_PAT }}
 
-      - name: Build
-        run: |
-          docker build \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            .
-
-      - name: Push
-        run: |
-          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${IMAGE}:latest"
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}
+            ${{ env.IMAGE }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/Dockerfile b/Dockerfile
index c3c36f6..eb5ec97 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,53 +1,38 @@
-# Build stage
-FROM rust:1-slim-bookworm AS builder
+# Multi-stage build for Poimen Memory Service (Rust)
 
-WORKDIR /app
+# Stage 1: Builder
+FROM rust:1.81-bookworm as builder
 
-# Install build dependencies
-RUN apt-get update && apt-get install -y \
-    pkg-config \
-    libssl-dev \
-    g++ \
-    && rm -rf /var/lib/apt/lists/*
+WORKDIR /build
 
-# Copy manifests, source, and compile-time assets
-COPY Cargo.toml Cargo.lock ./
-RUN mkdir -p src && echo '// workspace root' > src/lib.rs
-COPY crates ./crates
-COPY templates ./templates
+# Copy source
+COPY . .
 
-# Build release binary
-RUN cargo build --release -p mem-cli --bin mem
+# Build in release mode
+RUN cargo build --release
 
-# Runtime stage
+# Stage 2: Runtime
 FROM debian:bookworm-slim
 
 WORKDIR /app
 
 # Install runtime dependencies
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     libssl3 \
+    postgresql-client \
+    curl \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy binary from builder
-COPY --from=builder /app/target/release/mem /usr/local/bin/mem
+COPY --from=builder /build/target/release/mem /app/mem
 
-# Copy templates and queries
-COPY templates ./templates
-COPY queries ./queries
-
-# Create non-root user
-RUN useradd -r -u 1000 memuser
-USER memuser
-
-# Default port
+# Expose port
 EXPOSE 8080
 
 # Health check
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD curl -f http://localhost:8080/health || exit 1
+HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=3 \
+  CMD curl -f http://localhost:8080/health || exit 1
 
-# Default command: start HTTP server
-ENTRYPOINT ["mem"]
-CMD ["serve", "--port", "8080"]
+# Run
+CMD ["/app/mem"]