diff --git a/build.yaml b/build.yaml
index 744ae947a..db1f06b16 100644
--- a/build.yaml
+++ b/build.yaml
@@ -46,3 +46,9 @@ machamp:
         # https://github.sc-corp.net/Snapchat/img/tree/master/keydb/ubuntu-20-04
         builder_image: us.gcr.io/snapchat-build-artifacts/prod/snapchat/img/keydb/keydb-ubuntu-20-04@sha256:cf869a3f5d1de1e1d976bb906689c37b7031938eb68661b844a38c532f27248c
         command: ./runtest-rotation
+      docker:
+        parent: make-build
+        type: docker # published images can be found in https://console.cloud.google.com/gcr/images/machamp-prod/global/keydb
+        dockerfile: machamp_scripts/Dockerfile
+        image_name: keydb # git commit sha will be deafult tag in the final image
+        workspace_context: ./ # This is the workspace context that your Dockerfile will use to move files around. <Root of checkout repository>/<Workspace Context>/<Dockerfile> If the workspace context is just the root of the repository, you can just use "./".
diff --git a/ci.yaml b/ci.yaml
index ab346113f..7e83f89b9 100644
--- a/ci.yaml
+++ b/ci.yaml
@@ -1,16 +1,27 @@
 # Doc: https://wiki.sc-corp.net/display/TOOL/ci.yaml+User+Guide
 version: 1
 on:
+  # https://wiki.sc-corp.net/display/TOOL/Onboard+Machamp+Build+By+ci.yaml+Configuration
+  # on pull_request is used for any pr build
   pull_request:
-    - workflows:
-      # All builds that use machamp should use the defined `backend_workflow`
-      - workflow_type: backend_workflow
-        # references a build defined in build.yaml
-        build_name: keydb-build
-        arch_types: ["amd64", "arm64"]
+    - branches: ['!!main', '*'] # this branch pattern means any branch but not main branch will trigger this pr build
+      workflows:
+        # All builds that use machamp should use the defined `backend_workflow`
+        - workflow_type: backend_workflow
+          # references a build defined in build.yaml
+          build_name: keydb-build
+          arch_types: ["amd64", "arm64"]
+  # on push is used for release branch, meaning: trigger this build when there is commit pushed to this branch
   push:
     - branches: [main]
       workflows:
         - workflow_type: backend_workflow
           build_name: keydb-build
           arch_types: ["amd64", "arm64"]
+
+# below defines which branch is release branch / release tag
+machamp:
+  releases:
+    # Note: machamp will only respect the ci.yaml file from default branch for "release branch" definition (most repositories using master/main as default branch)
+    # https://wiki.sc-corp.net/display/TOOL/Onboard+Machamp+Build+By+ci.yaml+Configuration
+    - branch_name: ^main$
diff --git a/machamp_scripts/Dockerfile b/machamp_scripts/Dockerfile
new file mode 100644
index 000000000..b7f3bf6e4
--- /dev/null
+++ b/machamp_scripts/Dockerfile
@@ -0,0 +1,114 @@
+FROM ubuntu:20.04
+SHELL ["/bin/bash","-c"]
+RUN groupadd -r keydb && useradd -r -g keydb keydb
+# use gosu for easy step-down from root: https://github.com/tianon/gosu/releases
+ENV GOSU_VERSION 1.14
+RUN set -eux; \
+        savedAptMark="$(apt-mark showmanual)"; \
+        apt-get update; \
+        apt-get -o Dpkg::Options::="--force-confnew" install -y --no-install-recommends ca-certificates dirmngr gnupg wget; \
+        rm -rf /var/lib/apt/lists/*; \
+        dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
+        wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
+        wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
+        export GNUPGHOME="$(mktemp -d)"; \
+        gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
+        gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
+        gpgconf --kill all; \
+        rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
+        apt-mark auto '.*' > /dev/null; \
+        [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        chmod +x /usr/local/bin/gosu; \
+        gosu --version; \
+        gosu nobody true
+# build KeyDB
+ARG MAKE_JOBS=""
+ARG ENABLE_FLASH=""
+COPY . /tmp/keydb-internal
+RUN set -eux; \
+        cd /tmp/keydb-internal; \
+        savedAptMark="$(apt-mark showmanual)"; \
+        apt-get update; \
+        DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::="--force-confnew" install -qqy --no-install-recommends \
+                dpkg-dev \
+                pkg-config \
+                ca-certificates \
+                build-essential \
+                nasm \
+                autotools-dev \
+                autoconf \
+                libjemalloc-dev \
+                tcl \
+                tcl-dev \
+                uuid-dev \
+                libcurl4-openssl-dev \
+                libbz2-dev \
+                libzstd-dev \
+                liblz4-dev \
+                libsnappy-dev \
+                libssl-dev \
+                git; \
+        # disable protected mode as it relates to docker
+        grep -E '^ *createBoolConfig[(]"protected-mode",.*, *1 *,.*[)],$' ./src/config.cpp; \
+        sed -ri 's!^( *createBoolConfig[(]"protected-mode",.*, *)1( *,.*[)],)$!\10\2!' ./src/config.cpp; \
+        grep -E '^ *createBoolConfig[(]"protected-mode",.*, *0 *,.*[)],$' ./src/config.cpp; \
+        make distclean; \
+        make -j$([ -z "$MAKE_JOBS" ] &&  nproc || echo "$MAKE_JOBS") BUILD_TLS=yes NO_LICENSE_CHECK=yes $([ -z "$ENABLE_FLASH" ] &&  echo "" || echo "ENABLE_FLASH=$ENABLE_FLASH"); \
+        cd src; \
+        mv modules/keydb_modstatsd/modstatsd.so /usr/local/lib/; \
+        strip keydb-cli keydb-benchmark keydb-check-rdb keydb-check-aof keydb-diagnostic-tool keydb-sentinel; \
+        mv keydb-server keydb-cli keydb-benchmark keydb-check-rdb keydb-check-aof keydb-diagnostic-tool keydb-sentinel /usr/local/bin/; \
+        # clean up unused dependencies
+        echo $savedAptMark; \
+        apt-mark auto '.*' > /dev/null; \
+        [ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
+        find /usr/local -type f -executable -exec ldd '{}' ';' \
+               | awk '/=>/ { print $(NF-1) }' \
+               | sed 's:.*/::' \
+               | sort -u \
+               | xargs -r dpkg-query --search \
+               | cut -d: -f1 \
+               | sort -u \
+               | xargs -r apt-mark manual \
+        ; \
+        apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
+        rm -rf /var/lib/apt/lists/*; \
+# create working directories and organize files
+RUN \
+        mkdir /data && chown keydb:keydb /data; \
+        mkdir /flash && chown keydb:keydb /flash; \
+        mkdir -p /etc/keydb; \
+        cp /tmp/keydb-internal/keydb.conf /etc/keydb/; \
+        sed -i 's/^\(daemonize .*\)$/# \1/' /etc/keydb/keydb.conf; \
+        sed -i 's/^\(dir .*\)$/# \1\ndir \/data/' /etc/keydb/keydb.conf; \
+        sed -i 's/^\(logfile .*\)$/# \1/' /etc/keydb/keydb.conf; \
+        sed -i 's/protected-mode yes/protected-mode no/g' /etc/keydb/keydb.conf; \
+        sed -i 's/^\(bind .*\)$/# \1/' /etc/keydb/keydb.conf; \
+        echo -e "\nloadmodule /usr/local/lib/modstatsd.so" >> /etc/keydb/keydb.conf; \
+	ln -s keydb-cli redis-cli; \
+        cd /etc/keydb; \
+        ln -s keydb.conf redis.conf; \
+        rm -rf /tmp/*
+# generate entrypoint script
+RUN set -eux; \
+        echo '#!/bin/sh' > /usr/local/bin/docker-entrypoint.sh; \
+        echo 'set -e' >> /usr/local/bin/docker-entrypoint.sh; \
+        echo "# perpend 'keydb-server' if not provided as first argument" >> /usr/local/bin/docker-entrypoint.sh; \
+        echo 'if [ "${1}" != "keydb-server" ]; then' >> /usr/local/bin/docker-entrypoint.sh; \
+        echo '        set -- keydb-server "$@"' >> /usr/local/bin/docker-entrypoint.sh; \
+        echo 'fi' >> /usr/local/bin/docker-entrypoint.sh; \
+        echo "# allow the container to be started with `--user`" >> /usr/local/bin/docker-entrypoint.sh; \
+        echo 'if [ "$1" = "keydb-server" -a "$(id -u)" = "0" ]; then' >> /usr/local/bin/docker-entrypoint.sh; \
+        echo "        find . \! -user keydb -exec chown keydb '{}' +" >> /usr/local/bin/docker-entrypoint.sh; \
+        echo '        exec gosu keydb "$0" "$@"' >> /usr/local/bin/docker-entrypoint.sh; \
+        echo 'fi' >> /usr/local/bin/docker-entrypoint.sh; \
+        echo 'exec "$@"' >> /usr/local/bin/docker-entrypoint.sh; \
+        chmod +x /usr/local/bin/docker-entrypoint.sh
+# set remaining image properties
+VOLUME /data
+WORKDIR /data
+ENV KEYDB_PRO_DIRECTORY=/usr/local/bin/
+ENTRYPOINT ["docker-entrypoint.sh"]
+EXPOSE 6379
+CMD ["keydb-server","/etc/keydb/keydb.conf"]