diff --git a/.github/workflows/build_and_push_alinux2_image.yml b/.github/workflows/build_and_push_alinux2_image.yml
new file mode 100644
index 00000000..04fd9dfb
--- /dev/null
+++ b/.github/workflows/build_and_push_alinux2_image.yml
@@ -0,0 +1,87 @@
+name: Alinux2 Docker Build and Push
+
+# This is a manual trigger.
+on:
+  workflow_dispatch:
+    inputs:
+      only_test:
+        description: 'Only Test? <Y/N>'
+        required: true
+        default: 'N'
+
+jobs:
+  generate-alinux2-image:
+    runs-on: ubuntu-18.04
+    if: github.event.inputs.only_test == 'N'
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+
+    # Because "Build and push" step `context` field can't be subdir,
+    # we need to copy files needed by dockerfile to root dir of the project
+    - name: Copy context for docker build
+      run: |
+        cp -r tools/toolchains .
+        cp -r tools/docker .
+
+    - name: Get Occlum release version
+      run: echo "RELEASE_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
+
+    - name: Get branch name
+        # GITHUB_REF=refs/heads/branch-name
+        # ${GITHUB_REF##*/} == branch-name
+      run: echo "OCCLUM_BRANCH=$(echo ${GITHUB_REF##*/})" >> $GITHUB_ENV;
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v1
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v1
+      with:
+        driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=104857600
+
+    - name: Login to DockerHub
+      uses: docker/login-action@v1
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+
+    - name: Build and push
+      uses: docker/build-push-action@v2
+      with:
+        context: .
+        file: ./tools/docker/Dockerfile.aliyunlinux
+        platforms: linux/amd64
+        build-args: OCCLUM_BRANCH=${{ env.OCCLUM_BRANCH }}
+        push: true
+        tags: occlum/occlum:${{ env.RELEASE_VERSION }}-aliyunlinux
+
+
+  Make_test_on_alinux2:
+    if: ${{ always() }}
+    needs: generate-alinux2-image
+    runs-on: ubuntu-18.04
+
+    steps:
+    - uses: actions/checkout@v1
+      with:
+        submodules: true
+
+    - name: Get occlum version
+      run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
+
+    - name: Create container with Aliyun Linux image
+      run: docker run -itd --name=alinux2-test -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:${{ env.OCCLUM_VERSION }}-aliyunlinux
+
+    - name: Build dependencies
+      run:  docker exec alinux2-test bash -c "cd /root/occlum; make submodule"
+
+    - name: Build source
+      run:  docker exec alinux2-test bash -c "cd /root/occlum; OCCLUM_RELEASE_BUILD=y SGX_MODE=SIM make"
+
+    - name: Integration test
+      run:  docker exec alinux2-test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace SGX_MODE=SIM make test"
+
+    - name: Integration test with Glibc
+      run:  docker exec alinux2-test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace SGX_MODE=SIM make test-glibc"
diff --git a/tools/docker/Dockerfile.aliyunlinux b/tools/docker/Dockerfile.aliyunlinux
new file mode 100644
index 00000000..cf51eccd
--- /dev/null
+++ b/tools/docker/Dockerfile.aliyunlinux
@@ -0,0 +1,192 @@
+FROM alpine:3.11 AS alpine
+
+RUN apk update && \
+    apk --no-cache add openjdk11 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
+
+FROM registry.cn-hangzhou.aliyuncs.com/alinux/aliyunlinux
+
+LABEL maintainer="Chunyang Hui <sanqian.hcy@antgroup.com>"
+
+RUN yum install -y --nogpgcheck \
+        alinux-release-experimentals && \
+        yum install -y --nogpgcheck \
+        astyle \
+        autoconf \
+        automake \
+        bison \
+        bzip2 \
+        boost-devel \
+        ca-certificates \
+        cmake \
+        curl \
+        curl-devel \
+        createrepo \
+        expect \
+        expat \
+        expat-devel \
+        gettext \
+        file \
+        fuse-devel \
+        fuse-libs \
+        gawk \
+        gcc \
+        gcc-c++ \
+        glibc-headers \
+        gdb \
+        git-core \
+        gmp-devel \
+        golang \
+        jq \
+        libmpc-devel \
+        libxml2-devel \
+        libtool \
+        pkgconfig \
+        python \
+        kmod \
+        make \
+        mod_ssl \
+        mpfr-devel \
+        ocaml \
+        ocaml-ocamlbuild \
+        openssl \
+        openssl-devel \
+        patch \
+        python3 \
+        sudo \
+        uuid-devel \
+        vim \
+        wget \
+        yum-utils && \
+    yum groupinstall -y 'Development Tools' && \
+    yum clean all
+
+# Upgrade gcc to compile occlum toolchain.
+# This may vary across different platforms depending on the source of gcc.
+# Use aliyunlinux devtoolset to upgrade gcc to 8.
+RUN yum install -y scl-utils alinux-release-experimentals rpm-build && \
+    yum install -y devtoolset-8-gcc-c++ devtoolset-8-gcc devtoolset-8-gdb devtoolset-8-binutils devtoolset-8-make && \
+    printf "unset BASH_ENV PROMPT_COMMAND ENV\nsource scl_source enable devtoolset-8\n" > /usr/bin/scl_enable
+
+ENV BASH_ENV="/usr/bin/scl_enable"
+ENV ENV="/usr/bin/scl_enable"
+ENV PROMPT_COMMAND=". /usr/bin/scl_enable"
+
+# With alinux-release-experimentals, install higher version of git and protobuf (3.5).
+RUN yum install -y \
+        git \
+        protobuf \
+        protobuf-c \
+        protobuf-compiler \
+        protobuf-c-compiler \
+        protobuf-c-devel \
+        protobuf-devel
+
+# Install PSW and DCAP RPM packages
+WORKDIR /tmp
+RUN wget https://mirrors.openanolis.org/inclavare-containers/alinux2/sgx_rpm_local_repo.tar.gz && \
+    tar -xzf sgx_rpm_local_repo.tar.gz && \
+    rm -f sgx_rpm_local_repo.tar.gz && \
+    cd /tmp/sgx_rpm_local_repo && \
+    rpm -ivh --nodeps libsgx-ae-pce*.rpm \
+    libsgx-headers*.rpm \
+    libsgx-ae-qe3*.rpm \
+    libsgx-ae-qve*.rpm \
+    libsgx-enclave-common*.rpm \
+    libsgx-quote-ex*.rpm \
+    libsgx-urts*.rpm \
+    libsgx-dcap-ql*.rpm \
+    libsgx-qe3-logic*.rpm \
+    libsgx-pce-logic*.rpm \
+    libsgx-dcap-quote-verify*.rpm \
+    libsgx-dcap-ql*.rpm \
+    libsgx-dcap-ql-dev*.rpm \
+    libsgx-dcap-default-qpl*.rpm \
+    libsgx-dcap-default-qpl-dev*.rpm \
+    libsgx-dcap-quote-verify-dev*.rpm \
+    libsgx-uae-service*.rpm \
+    libsgx-epid*.rpm \
+    libsgx-launch*.rpm \
+    libsgx-ae-le-*.rpm \
+    libsgx-aesm-launch-plugin-*.rpm \
+    sgx-aesm-service*.rpm && \
+    rm -rf /tmp/sgx_rpm_local_repo
+
+# Install SGX SDK
+WORKDIR /tmp
+RUN git clone -b sgx_2.13_for_occlum https://github.com/occlum/linux-sgx && \
+    cd linux-sgx && \
+    make preparation && \
+    ./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
+    echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
+    rm -rf /tmp/linux-sgx
+
+# Install cpuid tool for tests
+WORKDIR /tmp
+RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
+    tar -xf ./cpuid-20200211.x86_64.tar.gz && \
+    cp ./cpuid-20200211/cpuid /usr/bin/ && \
+    rm -rf /tmp/cpuid-20200211*
+
+# Install Occlum toolchain
+COPY toolchains/musl-gcc /tmp/musl-gcc
+WORKDIR /tmp
+RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && rm -rf /tmp/musl-gcc
+ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH"
+
+# Install glibc
+COPY toolchains/glibc /tmp/glibc
+WORKDIR /tmp
+RUN cd glibc && ./build.sh && rm -rf /tmp/glibc
+
+# Install Occlum Golang toolchain
+COPY toolchains/golang /tmp/golang
+WORKDIR /tmp
+RUN yum install -y go && cd golang && ./build.sh && rm -rf /tmp/golang
+ENV PATH="/usr/local/occlum/golang/bin:$PATH"
+
+# Install Occlum Java toolchain (JDK 11)
+ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk
+COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH
+RUN rm $JDK11_PATH/lib/security/cacerts
+COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts
+COPY toolchains/java /tmp/java
+WORKDIR /tmp
+RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
+ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
+
+# Install Rust
+ENV PATH="/root/.cargo/bin:$PATH"
+ENV OCCLUM_RUST_VERSION=nightly-2020-09-08
+RUN curl https://sh.rustup.rs -sSf | \
+        sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \
+    rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \
+    cargo -V
+
+# Install Occlum Rust toolchain
+COPY toolchains/rust /tmp/rust
+WORKDIR /tmp
+RUN cd rust && ./build.sh && rm -rf /tmp/rust
+ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH"
+
+ARG OCCLUM_BRANCH
+ENV LD_LIBRARY_PATH="/opt/intel/sgxpsw/aesm:/usr/lib64/:/usr/local/lib:/opt/intel/sgxsdk/sdk_libs:/usr/lib:$LD_LIBRARY_PATH"
+# Install the latest version of Occlum
+WORKDIR /root/occlum
+RUN rm -rf occlum && \
+    source scl_source enable devtoolset-8 && \
+    git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
+    cd occlum && \
+    make submodule && \
+    OCCLUM_RELEASE_BUILD=1 make install && \
+    cp -r demos /root/demos && \
+    rm -rf /root/occlum
+
+# Start AESM service automatically
+#
+# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
+# as a "real" service since the pid 1 is not systemd in Docker. So we start
+# up AESM service when an user login with an interative shell.
+COPY docker/start_aesm.sh /opt/occlum/
+RUN mkdir -p /var/run/aesmd && echo 'sudo /opt/occlum/start_aesm.sh' >> /root/.bashrc
+
+WORKDIR /root