diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b545207
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,19 @@
+# syntax=docker/dockerfile:1
+
+# ---- build: compile anubis with your overlaid mascot baked in ----
+FROM golang:1.24-bookworm AS build
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+ && apt-get install -y --no-install-recommends nodejs \
+ && rm -rf /var/lib/apt/lists/*
+ENV HUSKY=0
+WORKDIR /src
+COPY . .                       # context = upstream checkout, with mascot/*.webp already copied in
+RUN npm ci
+RUN mkdir -p var && npm run build    # go generate + web/xess assets + go build -> ./var/anubis
+
+# ---- runtime: minimal, same uid/gid as upstream's image ----
+FROM gcr.io/distroless/base-debian12
+COPY --from=build /src/var/anubis /usr/local/bin/anubis
+USER 1000:1000
+EXPOSE 8923 9090
+ENTRYPOINT ["/usr/local/bin/anubis"]
\ No newline at end of file