diff --git a/.github/workflows/jupyter-base-image-build-push.yaml b/.github/workflows/jupyter-base-image-build-push.yaml
new file mode 100644
index 0000000..5a8d712
--- /dev/null
+++ b/.github/workflows/jupyter-base-image-build-push.yaml
@@ -0,0 +1,70 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches:
+      - '**'
+    paths:
+      - 'jupyter-base-image/**'
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            nauedu/nau-analytics-base-jupyter
+          tags: |
+            type=sha
+
+      - name: Build Docker image (no push yet)
+        uses: docker/build-push-action@v6
+        with:
+          context: ./
+          file: ./jupyter-base-image/Dockerfile
+          load: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Login to DockerHub
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Push Docker image (branch-specific)
+        if: ${{ github.event_name != 'pull_request' }}
+        run: |
+          set -eux
+          IMAGE_NAME="nauedu/nau-analytics-base-jupyter"
+          SHA_TAG=$(echo "${GITHUB_SHA}" | head -c7)
+
+          if [ "${GITHUB_REF_NAME}" = "main" ]; then
+            # Tag and push with 'latest' and SHA
+            docker tag $IMAGE_NAME:sha-$SHA_TAG $IMAGE_NAME:latest
+            docker tag $IMAGE_NAME:sha-$SHA_TAG $IMAGE_NAME:$SHA_TAG
+
+            docker push $IMAGE_NAME:latest
+            docker push $IMAGE_NAME:$SHA_TAG
+
+            echo "✅ Pushed tags 'latest' and '$SHA_TAG' for main branch to https://hub.docker.com/r/$IMAGE_NAME/tags"
+          else
+            # Tag and push with branch name
+            BRANCH_TAG=$(echo "${GITHUB_REF_NAME}" | tr '/' '-')
+            docker tag $IMAGE_NAME:sha-$SHA_TAG $IMAGE_NAME:$BRANCH_TAG
+            docker push $IMAGE_NAME:$BRANCH_TAG
+
+            echo "✅ Pushed branch tag '$BRANCH_TAG' to https://hub.docker.com/r/$IMAGE_NAME/tags"
+          fi
diff --git a/jupyter-base-image/.dockerignore b/jupyter-base-image/.dockerignore
new file mode 100644
index 0000000..95e38bf
--- /dev/null
+++ b/jupyter-base-image/.dockerignore
@@ -0,0 +1,2 @@
+**
+!./*
\ No newline at end of file
diff --git a/jupyter-base-image/Dockerfile b/jupyter-base-image/Dockerfile
new file mode 100644
index 0000000..8a8909f
--- /dev/null
+++ b/jupyter-base-image/Dockerfile
@@ -0,0 +1,27 @@
+FROM nauedu/nau-analytics-base-spark:latest
+
+# Env for Jupyter + PySpark
+ENV HOME=/home/spark \
+    JUPYTER_PORT=8888 \
+    JUPYTER_DIR=/opt/spark/work-dir/notebooks \
+    PYSPARK_PYTHON=/usr/local/bin/python3.11 \
+    PYSPARK_DRIVER_PYTHON=/usr/local/bin/python3.11 \
+    PYTHONPATH="${SPARK_HOME}/python"
+
+USER root
+
+# garante dirs + permissões antes de instalar
+RUN mkdir -p "${JUPYTER_DIR}" /home/spark \
+    && chown -R 185:185 /home/spark /opt/spark
+
+# PySpark + JupyterLab + libs
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir jupyterlab==4.2.5
+
+RUN pip install --no-cache-dir git+https://github.com/fccn/nau-analytics-utils.git@main#subdirectory=common_libs/utils
+USER 185
+WORKDIR ${JUPYTER_DIR}
+
+EXPOSE 8888
+
+ENTRYPOINT ["bash","-lc","jupyter lab --ip=0.0.0.0 --port=${JUPYTER_PORT} --no-browser --ServerApp.root_dir=${JUPYTER_DIR} --ServerApp.token='' --ServerApp.password=''"]
\ No newline at end of file