diff --git a/.github/workflows/build_push_cn_node_image.yaml b/.github/workflows/build_push_cn_node_image.yaml
new file mode 100644
index 0000000..373865a
--- /dev/null
+++ b/.github/workflows/build_push_cn_node_image.yaml
@@ -0,0 +1,23 @@
+name: Build & Push StarRocks CN Image to GHCR
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+  push:
+    branches:
+      - main
+      - master
+      - develop
+
+jobs:
+  trigger-build-push:
+    uses: ./.github/workflows/build_push_node_images.yaml
+    with:
+      node_name: cn
+      docker_file: './DockerFile_ComputeNode'
+    secrets: inherit
diff --git a/.github/workflows/build_push_fe_node_image.yaml b/.github/workflows/build_push_fe_node_image.yaml
new file mode 100644
index 0000000..cdbe72b
--- /dev/null
+++ b/.github/workflows/build_push_fe_node_image.yaml
@@ -0,0 +1,23 @@
+name: Build & Push StarRocks FE Image to GHCR
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+  push:
+    branches:
+      - main
+      - master
+      - develop
+
+jobs:
+  trigger-build-push:
+    uses: ./.github/workflows/build_push_node_images.yaml
+    with:
+      node_name: fe
+      docker_file: './DockerFile_FrontEnd'
+    secrets: inherit
diff --git a/.github/workflows/build_push_node_images.yaml b/.github/workflows/build_push_node_images.yaml
new file mode 100644
index 0000000..429b8dc
--- /dev/null
+++ b/.github/workflows/build_push_node_images.yaml
@@ -0,0 +1,50 @@
+name: Build & Push StarRocks Node to GHCR
+
+on:
+  workflow_call:
+    inputs:
+      node_name:
+        description: 'Name of the node to build and push, e.g. fe or cn'
+        required: true
+        type: string
+      docker_file:
+        description: 'Path to the docker file'
+        required: true
+        type: string
+
+jobs:
+  build-push-tool-images:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out GitHub Repo
+        uses: actions/checkout@v4
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: '${{ secrets.GHCR_USERNAME }}'
+          password: '${{ secrets.GHCR_TOKEN }}'
+
+      - name: Build and push node images
+        id: build-and-push
+        run: |
+          dockerfile=${{ inputs.docker_file }}
+          tag="ghcr.io/${{ github.event.repository.owner.login }}/${{ github.event.repository.name }}:${{inputs.node_name}}-pr-${{ github.event.number }}"
+
+          echo "Building and pushing ${{ inputs.node_name }} image..."
+          echo "tagging image with $tag"
+
+          docker buildx build --file "$dockerfile" --tag "$tag" \
+            --build-arg "BUILD_DATE=${{ steps.date.outputs.date }}" \
+            --build-arg "VCS_REF=${{ github.sha }}" \
+            --build-arg "BRANCH=${{ github.ref }}" \
+            --build-arg "TAG=${{ github.ref }}" \
+            --push .
diff --git a/README.md b/README.md
index af536b9..527b692 100644
--- a/README.md
+++ b/README.md
@@ -24,3 +24,9 @@ In particular, see the *entrypoint.sh fiels for variables that are set to defaul
 ## Notes
 
 * The dockerfiles use mostly default values, which is almost certainly bad.
+
+## TODO
+
+* Make GHA to push images from a release if we ever get to that point
+* Dependabot / Trivy
+* Tests...? Could start up the images and make sure they're contactable I guess
diff --git a/scripts/fe-setup.sh b/scripts/fe-setup.sh
index fbae7df..5dd5411 100644
--- a/scripts/fe-setup.sh
+++ b/scripts/fe-setup.sh
@@ -1,7 +1,5 @@
 #!/bin/sh
 
-# TODO: image buids
-
 TF=/opt/starrocks/fe/conf/fe.conf
 
 # NOTE: All FE nodes in a cluster must have the same http port: