diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..c28404d
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,39 @@
+# Version control and local tooling
+.git
+.github
+.agents
+.codex
+.vscode
+.idea
+**/.DS_Store
+**/Thumbs.db
+*.swp
+
+# Dependencies and generated output
+**/node_modules
+**/dist
+**/coverage
+/.angular
+/out-tsc
+/tmp
+*.log
+
+# Secrets and local environment files
+.env
+.env.*
+**/.env
+**/.env.*
+
+# Angular frontend (the image deploys only /server)
+/src
+/public
+/angular.json
+/package.json
+/package-lock.json
+/tsconfig*.json
+/eslint.config.js
+/.postcssrc.json
+/proxy.conf.json
+
+# Backend files not needed to build or run the image
+/server/test
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..08d9d12
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+FROM node:24.18.0-bookworm-slim AS build
+
+WORKDIR /app
+
+COPY server/package.json server/package-lock.json ./
+RUN npm ci
+
+COPY server/tsconfig.json ./
+COPY server/src ./src
+RUN npm run build
+
+FROM node:24.18.0-bookworm-slim AS runtime
+
+ENV NODE_ENV=production
+
+WORKDIR /app
+
+COPY server/package.json server/package-lock.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+COPY --from=build --chown=node:node /app/dist ./dist
+
+USER node
+
+CMD ["node", "dist/index.js"]