diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..83bcaba
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+node_modules
+dist
+data
+*.log
+.git
+.env
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..04bc574
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,36 @@
+# ---- frontend ----
+FROM node:22-bookworm-slim AS frontend-build
+WORKDIR /build/frontend
+COPY frontend/package*.json ./
+RUN npm ci
+COPY frontend/ ./
+RUN npm run build
+
+# ---- server ----
+FROM node:22-bookworm-slim AS server-build
+WORKDIR /build/server
+COPY server/package*.json ./
+RUN npm ci
+COPY server/ ./
+RUN npm run build && npm prune --omit=dev
+
+# ---- runtime ----
+FROM node:22-bookworm-slim
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --from=server-build /build/server/node_modules ./node_modules
+COPY --from=server-build /build/server/package.json ./package.json
+COPY --from=server-build /build/server/dist ./dist
+COPY --from=frontend-build /build/frontend/dist ./public
+RUN mkdir -p /data && chown node:node /data
+USER node
+ENV NODE_ENV=production \
+    PORT=8199 \
+    DATA_DIR=/data \
+    STATIC_DIR=/app/public
+EXPOSE 8199
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+    CMD curl -fsS http://localhost:8199/api/health || exit 1
+CMD ["node", "dist/index.js"]