diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..782d0104
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,23 @@
+.github
+.vscode
+target
+Cargo.lock
+node_modules
+
+circuit_setup/scripts/__pycache__
+circuit_setup/inputs/*
+!circuit_setup/inputs/**/*.json
+circuit_setup/generated_files/*
+circuit_setup/circuits-mdl/circomlib
+circuit_setup/circuits/circomlib
+
+creds/test-vectors/*
+creds/pkg
+
+sample/client/dist
+sample/client/mdl.json
+sample/client_helper/data
+sample/issuer/data
+sample/issuer/keys
+sample/issuer/.well-known
+sample/verifier/data
\ No newline at end of file
diff --git a/.github/workflows/docker_ci.yml b/.github/workflows/docker_ci.yml
new file mode 100644
index 00000000..d55c59a3
--- /dev/null
+++ b/.github/workflows/docker_ci.yml
@@ -0,0 +1,79 @@
+name: Weekly build of Sample Docker CI
+
+on:
+ 
+  workflow_dispatch:
+
+  # 1) Weekly schedule
+  schedule:
+    - cron: '0 0 * * 0'    # every Sunday at 00:00 UTC
+
+  # 2) Trigger when the Dockerfile is changed on main
+  push:
+    branches: [ main ]
+    paths:
+      - 'Dockerfile'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'Dockerfile'
+
+jobs:
+  build-and-smoke-test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Cache Docker layers
+        uses: actions/cache@v3
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: Build crescent-sample image
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: Dockerfile
+          load: true
+          tags: crescent-sample:weekly
+
+      - name: Smoke-test extension export
+        run: |
+          df -h
+          ls -la /usr/share/dotnet
+          ls -la /opt/ghc
+          ls -la /usr/local/lib/android
+          ls -la /opt/hostedtoolcache
+
+          OUTDIR="${GITHUB_WORKSPACE}/crescent-extension"
+          rm -rf "$OUTDIR"
+          mkdir -p "$OUTDIR"
+
+          # Directly copy the built extension & mDL into the host volume
+          docker run --rm \
+            -v "$OUTDIR:/extension" \
+            crescent-sample:weekly \
+            /bin/bash -c "\
+              cp -r /crescent-credentials/sample/client/dist/* /extension/ && \
+              cp /crescent-credentials/sample/client/mdl.cbor.hex /extension/ \
+            "
+
+          # Fail if nothing was exported
+          if [ -z "$(ls -A "$OUTDIR")" ]; then
+            echo "❌ No extension files found in $OUTDIR"
+            exit 1
+          else
+            echo "✅ Extension export succeeded; files in $OUTDIR:"
+            ls -1 "$OUTDIR"
+          fi
diff --git a/sample/Dockerfile b/Dockerfile
similarity index 60%
rename from sample/Dockerfile
rename to Dockerfile
index c552fb0b..f92daea7 100644
--- a/sample/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@
 #    cd crescent-credentials
 #
 #    # Build the Docker image
-#    docker build -f sample/Dockerfile -t crescent-sample .
+#    docker build -t crescent-sample .
 #
 #
 #  Run the Docker container:
@@ -34,7 +34,7 @@
 #
 # 
 
-FROM rust:slim
+FROM rust:slim AS base
 
 SHELL ["/bin/bash", "-c"]
 
@@ -42,7 +42,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 ENV ROCKET_ADDRESS=0.0.0.0
 
 RUN apt-get update && apt-get upgrade -y && apt-get clean
-RUN apt-get install python3.11-venv python3-pip curl git dos2unix m4 cmake libclang-dev bsdextrautils -y
+RUN apt-get install python3.11-venv python3-pip curl git dos2unix m4 cmake libclang-dev bsdextrautils tree -y
 RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && apt-get install -y nodejs && node -v && npm -v
 
 # pip requires a virtual environment to not pollute the system python installation
@@ -54,42 +54,80 @@ RUN pip install python_jwt git+https://github.com/peppelinux/pyMDOC-CBOR.git
 # Install circom
 RUN git clone https://github.com/iden3/circom.git && cd circom && git checkout v2.1.6 && cargo build --release && cargo install --path circom;
 
+FROM base AS crescent
+
 # Copy local Crescent source code to the container
+# The .gitignore file will exclude build artifacts and other unnecessary files.
 COPY . /crescent-credentials
 
-# Fix line endings for all shell scripts as we may be copying from Windows
-RUN find /crescent-credentials -type f -name "*.sh" -exec dos2unix {} +
+
 
 WORKDIR /crescent-credentials
+
 RUN git submodule update --init --recursive;
+RUN rm -rf .git
+
+RUN tree -d
+RUN find . -type f -size +100M -exec stat --format="%s %n" {} +
+
+
+
+
+# From the repo, there is a symlink here that points to /crescent-credentials/circuit_setup/circuits/circomlib
+# On Windows, a script will replace the symlink with a Junction.
+# Symlinks do work on Windows but require admin privileges when not in developer mode.
+# COPY does not work with the Junction, so we ignore this directory in .dockerignore and re-create the original symlink here instead.
+# IMPORTANT: Keep this in sync with the symlink in the repo.
+WORKDIR /crescent-credentials/circuit_setup/circuits-mdl
+RUN ln -s ../circuits/circomlib circomlib
+
+WORKDIR /crescent-credentials
+
+# Fix line endings for all shell scripts as we may be copying from Windows
+RUN find /crescent-credentials -type f -name "*.sh" -exec dos2unix {} +
+
+RUN ./clean_all.sh
+
+FROM crescent AS setup
 
 WORKDIR /crescent-credentials/circuit_setup/scripts
-RUN ./run_setup.sh rs256
-RUN ./run_setup.sh rs256-sd
-RUN ./run_setup.sh rs256-db
+# RUN ./run_setup.sh rs256
+# RUN ./run_setup.sh rs256-sd
+# RUN ./run_setup.sh rs256-db
 RUN ./run_setup.sh mdl1
 
 WORKDIR /crescent-credentials/creds
-RUN cargo run --bin crescent --release --features print-trace zksetup --name rs256
-RUN cargo run --bin crescent --release --features print-trace prove --name rs256
-RUN cargo run --bin crescent --release --features print-trace show --name rs256
-RUN cargo run --bin crescent --release --features print-trace verify --name rs256
-RUN cargo run --bin crescent --release --features print-trace zksetup --name rs256-sd
-RUN cargo run --bin crescent --release --features print-trace prove --name rs256-sd
-RUN cargo run --bin crescent --release --features print-trace show --name rs256-sd
-RUN cargo run --bin crescent --release --features print-trace verify --name rs256-sd
-RUN cargo run --bin crescent --release --features print-trace zksetup --name rs256-db
-RUN cargo run --bin crescent --release --features print-trace prove --name rs256-db
-RUN cargo run --bin crescent --release --features print-trace show --name rs256-db
-RUN cargo run --bin crescent --release --features print-trace verify --name rs256-db
-RUN cargo run --bin crescent --release --features print-trace zksetup --name mdl1
-RUN cargo run --bin crescent --release --features print-trace prove --name mdl1
-RUN cargo run --bin crescent --release --features print-trace show --name mdl1
-RUN cargo run --bin crescent --release --features print-trace verify --name mdl1
+RUN cargo build --release --features print-trace --bin crescent
+
+# FROM setup AS rs256
+# RUN ./target/release/crescent zksetup --name rs256
+# RUN ./target/release/crescent prove --name rs256
+# RUN ./target/release/crescent show --name rs256
+# RUN ./target/release/crescent verify --name rs256
+
+# FROM rs256 AS rs256-sd
+# RUN ./target/release/crescent zksetup --name rs256-sd
+# RUN ./target/release/crescent prove --name rs256-sd
+# RUN ./target/release/crescent show --name rs256-sd
+# RUN ./target/release/crescent verify --name rs256-sd
+
+# FROM rs256-sd AS rs256-db
+# RUN ./target/release/crescent zksetup --name rs256-db
+# RUN ./target/release/crescent prove --name rs256-db
+# RUN ./target/release/crescent show --name rs256-db
+# RUN ./target/release/crescent verify --name rs256-db
+
+# FROM rs256-db AS mdl1
+FROM setup AS mdl1
+RUN ./target/release/crescent zksetup --name mdl1
+RUN ./target/release/crescent prove --name mdl1
+RUN ./target/release/crescent show --name mdl1
+RUN ./target/release/crescent verify --name mdl1
 
 WORKDIR /crescent-credentials/ecdsa-pop
 RUN cargo build --release
 
+FROM mdl1 AS sample
 WORKDIR /crescent-credentials/sample
 RUN ./setup-sample.sh
 
@@ -99,11 +137,10 @@ RUN echo '#!/bin/bash' > start-all.sh && \
     echo 'cd issuer && cargo run --release &' >> start-all.sh && \
     echo 'cd verifier && cargo run --release &' >> start-all.sh && \
     echo 'cp -r /crescent-credentials/sample/client/dist/* /extension/' >> start-all.sh && \
-    echo 'cp -r /crescent-credentials/sample/client/mdl.cbor.hex /extension/' >> start-all.sh && \
+    echo 'cp -r /crescent-credentials/sample/client/mdl.json /extension/' >> start-all.sh && \
     echo 'wait -n' >> start-all.sh && \
     chmod +x start-all.sh
 
 EXPOSE 8001 8003 8004
 
 CMD ["./start-all.sh"]
-