diff --git a/rsync/Dockerfile b/rsync/Dockerfile
new file mode 100644
index 0000000..5f9595f
--- /dev/null
+++ b/rsync/Dockerfile
@@ -0,0 +1,10 @@
+FROM alpine:3.16
+
+COPY entrypoint.sh /entrypoint
+
+RUN chmod +x /entrypoint && \
+    apk add --no-cache \
+        openssh-client \
+        rsync
+
+ENTRYPOINT ["/entrypoint"]
diff --git a/rsync/Makefile b/rsync/Makefile
new file mode 100644
index 0000000..5b2f684
--- /dev/null
+++ b/rsync/Makefile
@@ -0,0 +1,19 @@
+IMG_NAME=rsync
+REGISTRY=registry.monotremata.xyz
+IMG=$(REGISTRY)/$(IMG_NAME)
+PLATFORMS=linux/amd64,linux/arm64
+
+.PHONY: build push buildx
+
+build: Dockerfile entrypoint.sh
+	docker build -t $(IMG) .
+
+push: build
+	docker image push $(IMG)
+
+buildx: Dockerfile entrypoint.sh
+	docker buildx build \
+		--platform $(PLATFORMS) \
+		--tag $(IMG) \
+		--push \
+		.
diff --git a/rsync/entrypoint.sh b/rsync/entrypoint.sh
new file mode 100644
index 0000000..a5f4186
--- /dev/null
+++ b/rsync/entrypoint.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -e
+
+# check settings
+
+HOST="${HOST:-${PLUGIN_HOST}}"
+if [ -z "$HOST" ]; then
+    echo "'host' must be specified"
+    exit 1
+fi
+
+USER="${USER:-${PLUGIN_USER:-root}}"
+
+SSH_KEY="${SSH_KEY:-${PLUGIN_KEY}}"
+if [ -z "$SSH_KEY" ]; then
+    echo "ssh_key must be specified"
+    exit 1
+fi
+
+KNOWN_HOSTS="${KNOWN_HOSTS:=${PLUGIN_KNOWN_HOSTS}}"
+
+SOURCE="${SOURCE:-${PLUGIN_SOURCE}}"
+if [ -z "$SOURCE" ]; then
+    echo "'source' must be specified"
+    exit 1
+fi
+
+TARGET="${TARGET:-${PLUGIN_TARGET}}"
+if [ -z "$TARGET" ]; then
+    echo "'target' must be specified"
+    exit 1
+fi
+
+ARGS=${ARGS:-${PLUGIN_ARGS}}
+
+# prepare SSH
+
+mkdir -p "$HOME/.ssh"
+keyfile="$HOME/.ssh/id_rsa"
+echo "$SSH_KEY" > "$keyfile"
+chmod 0600 "$keyfile"
+
+known_hosts_file="${HOME}/.ssh/known_hosts"
+[ -n "${KNOWN_HOSTS}" ] && echo "${KNOWN_HOSTS}" >> "$known_hosts_file"
+[ -f "${known_hosts_file}" ] && chmod 0600 "$known_hosts_file"
+
+# run rsync
+
+# shellcheck disable=SC2086
+exec rsync $ARGS "${SOURCE}" "${USER}"@"${HOST}":"${TARGET}"