@@ -48,8 +48,20 @@ jobs:
       - name: Set up QEMU integration for Docker
         run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
 
+      # using such an action is more secure than using custom scripts
+      - name: Log into quay.io
+        uses: docker/login-action@v3
+        # secrets are not available when building a pull request
+        if: ${{ github.event_name != "pull_request" }}
+        with:
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_PASSPHRASE }}
+
       - name: Build
         run: bash ci/build-in-docker.sh
+        env:
+          CACHE_FROM: 1
+          PUSH_IMAGE: ${{ github.event_name == "pull_request" && "1" || "" }}
 
       - name: Archive artifacts
         uses: actions/upload-artifact@v2
 
@@ -57,7 +57,16 @@ else
     build_args+=("--pull")
 fi
 
-image_tag="linuxdeploy-build:$ARCH"
+image_tag="quay.io/theassassin/linuxdeploy-build:$ARCH"
+
+if [[ "${CACHE_FROM:-}" != "" ]]; then
+    warning "using cached image from quay: $image_tag"
+
+    build_args+=(
+        "--cache-from"
+        "$image_tag"
+    )
+fi
 
 docker build \
     --build-arg ARCH="$ARCH" \
@@ -66,6 +75,12 @@ docker build \
     -t "$image_tag" \
     "$this_dir"/docker
 
+# by default, we are not logged into the registry and therefore must not attempt to push the image
+if [[ "${PUSH_IMAGE:-}" ]]; then
+    warning "pushing image to quay (requires login): $image_tag"
+    docker push "$image_tag"
+fi
+
 docker_args=()
 # only if there's more than 1G of free space in RAM, we can build in a RAM disk
 if [[ "${GITHUB_ACTIONS:-}" != "" ]]; then