diff --git a/cumulus/.dockerignore b/cumulus/.dockerignore
index b0c40bf148c7d352554b325a7cda72e0ad173561..913065a3facf0086e7dc905f0e5eab36856ddf1e 100644
--- a/cumulus/.dockerignore
+++ b/cumulus/.dockerignore
@@ -3,6 +3,7 @@
 **/*.txt
 **/*.md
 /docker/
+!/target/release/polkadot-collator
 
 # dotfiles in the repo root
 /.*
diff --git a/cumulus/README.md b/cumulus/README.md
index 049a318c82ba524934d4cd089bcfdba8e65e6edc..e73e60c2633e2c6f3efe4a35468b448c06a00697 100644
--- a/cumulus/README.md
+++ b/cumulus/README.md
@@ -121,3 +121,17 @@ cargo build --release
 ```
 ### Register the parachain
 ![image](https://user-images.githubusercontent.com/2915325/99548884-1be13580-2987-11eb-9a8b-20be658d34f9.png)
+
+## Build the docker image
+
+After building `polkadot-collator` with cargo as documented in [this chapter](#build--launch-rococo-collators), the following will allow producting a new docker image where the compiled binary is injected:
+
+```
+./docker/scripts/build-injected-image.sh
+```
+
+You may then start a new contaier:
+
+```
+docker run --rm -it $OWNER/$IMAGE_NAME --collator --tmp --parachain-id 1000 --execution wasm --chain /specs/westmint.json
+```
diff --git a/cumulus/docker/injected.Dockerfile b/cumulus/docker/injected.Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..1ca6283aa7a55ac89ea1fd4fd298d2328d06e724
--- /dev/null
+++ b/cumulus/docker/injected.Dockerfile
@@ -0,0 +1,49 @@
+FROM docker.io/library/debian:buster-slim
+
+# metadata
+ARG VCS_REF
+ARG BUILD_DATE
+ARG IMAGE_NAME
+
+LABEL io.parity.image.authors="devops-team@parity.io" \
+	io.parity.image.vendor="Parity Technologies" \
+	io.parity.image.title="${IMAGE_NAME}" \
+	io.parity.image.description="polkadot: a platform for web3" \
+	io.parity.image.source="https://github.com/paritytech/polkadot/blob/${VCS_REF}/scripts/docker/Dockerfile" \
+	io.parity.image.revision="${VCS_REF}" \
+	io.parity.image.created="${BUILD_DATE}" \
+	io.parity.image.documentation="https://github.com/paritytech/cumulus/"
+
+# show backtraces
+ENV RUST_BACKTRACE 1
+
+# install tools and dependencies
+RUN apt-get update && \
+	DEBIAN_FRONTEND=noninteractive apt-get install -y \
+		libssl1.1 \
+		ca-certificates \
+		curl && \
+# apt cleanup
+	apt-get autoremove -y && \
+	apt-get clean && \
+	find /var/lib/apt/lists/ -type f -not -name lock -delete; \
+# add user and link ~/.local/share/polkadot to /data
+	useradd -m -u 1000 -U -s /bin/sh -d /polkadot polkadot && \
+	mkdir -p /data /polkadot/.local/share && \
+	chown -R polkadot:polkadot /data && \
+	ln -s /data /polkadot/.local/share/polkadot && \
+	mkdir -p /specs
+
+# add polkadot-collator binary to the docker image
+COPY ./target/release/polkadot-collator /usr/local/bin
+COPY ./polkadot-parachains/res/*.json /specs/
+
+USER polkadot
+
+# check if executable works in this container
+RUN /usr/local/bin/polkadot-collator --version
+
+EXPOSE 30333 9933 9944
+VOLUME ["/polkadot"]
+
+ENTRYPOINT ["/usr/local/bin/polkadot-collator"]
diff --git a/cumulus/docker/scripts/build-injected-image.sh b/cumulus/docker/scripts/build-injected-image.sh
new file mode 100755
index 0000000000000000000000000000000000000000..c498cff2f9d305c54d0e1b3d56548b7d7e5b7bba
--- /dev/null
+++ b/cumulus/docker/scripts/build-injected-image.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+OWNER=parity
+IMAGE_NAME=polkadot-collator
+docker build --no-cache --build-arg IMAGE_NAME=$IMAGE_NAME -t $OWNER/$IMAGE_NAME -f ./docker/injected.Dockerfile .
+docker images | grep $IMAGE_NAME
diff --git a/cumulus/docker/test-parachain-collator.dockerfile b/cumulus/docker/test-parachain-collator.dockerfile
index 37f1ffe4777055469708d824235696573bcc9135..35fe09c68a04f1c0a5bfad6da429d61a3617223b 100644
--- a/cumulus/docker/test-parachain-collator.dockerfile
+++ b/cumulus/docker/test-parachain-collator.dockerfile
@@ -19,7 +19,7 @@ WORKDIR /paritytech/cumulus
 # not the actual directory. We're stuck just enumerating them.
 COPY . .
 
-RUN cargo build --release -p polkadot-collator
+RUN cargo build --release --locked -p polkadot-collator
 
 # the collator stage is normally built once, cached, and then ignored, but can
 # be specified with the --target build flag. This adds some extra tooling to the
diff --git a/cumulus/polkadot-parachains/res/statemint.json b/cumulus/polkadot-parachains/res/statemint.json
old mode 100755
new mode 100644