diff --git a/docs/nix_dev_env.md b/docs/nix_dev_env.md
--- a/docs/nix_dev_env.md
+++ b/docs/nix_dev_env.md
@@ -127,6 +127,11 @@
     - [Committing a diff](./nix_shared_workflows.md#committing-a-diff)
   - [Final notes](./nix_shared_workflows.md#final-notes)
 
+## Production workflows
+
+- [Services deployment](./nix_services_deployment.md)
+  - [Tunnelbroker](./nix_services_deployment.md#tunnelbroker)
+
 ## Using alternate shells with Nix
 
 Alternate shells such as zsh or fish can also be used with Nix. To use an alternate shell, run:
diff --git a/docs/nix_services_deployment.md b/docs/nix_services_deployment.md
new file mode 100644
--- /dev/null
+++ b/docs/nix_services_deployment.md
@@ -0,0 +1,28 @@
+# Services Deployment
+
+## Tunnelbroker
+
+Deploying Tunnelbroker consists of building its Docker image and deploying that image as a Docker container.
+
+### Building Tunnelbroker Image
+
+The Docker image for Tunnelbroker can be built using the following command from the project root:
+
+```
+docker build -f services/tunnelbroker -t commapp/tunnelbroker:<tag> .
+# Alternatively, there's a script which creates a very small docker context before building
+services/tunnelbroker/make_docker_image.sh -t commapp/tunnelbroker:<tag> .
+```
+
+### Running the container
+
+Tunnelbroker can be run in production using the following command:
+
+```
+docker run -d commapp/tunnelbroker:<tag> \
+  -p 50051:50051 \
+  -p 80:51001 \
+  -v $HOME/.aws:/home/comm/.aws:ro \
+  tunnelbroker \
+  --amqp-uri=<amqp-uri> \
+```
diff --git a/services/tunnelbroker/make_docker_image.sh b/services/tunnelbroker/make_docker_image.sh
--- a/services/tunnelbroker/make_docker_image.sh
+++ b/services/tunnelbroker/make_docker_image.sh
@@ -16,4 +16,4 @@
 cp -r "${SCRIPT_DIR}"/{Cargo.toml,Cargo.lock,build.rs,src} \
   "$BUILD_DIR"/services/tunnelbroker/
 
-docker build -f "${SCRIPT_DIR}/Dockerfile" "$BUILD_DIR"
+docker build "$@" -f "${SCRIPT_DIR}/Dockerfile" "$BUILD_DIR"