diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..0b1e1e7
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,27 @@
+**/__pycache__
+**/.venv
+**/.classpath
+**/.dockerignore
+**/.env
+**/.git
+**/.gitignore
+**/.project
+**/.settings
+**/.toolstarget
+**/.vs
+**/.vscode
+**/*.*proj.user
+**/*.dbmdl
+**/*.jfm
+**/bin
+**/charts
+**/docker-compose*
+**/compose*
+**/Dockerfile*
+**/node_modules
+**/npm-debug.log
+**/obj
+**/secrets.dev.yaml
+**/values.dev.yaml
+LICENSE
+README.md
diff --git a/.gitignore b/.gitignore
index c4d6440..6a67833 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,6 @@ config/*.ini
 pastebin.txt
 .DS_Store
 test*.py
-.dockerignore
 docker-*
 .vscode
 
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..e24116d
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,22 @@
+# Base image (multi-arch via buildx)
+FROM python:3.10-slim
+
+# Prevents pyc files + enables unbuffered logging
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+# Install dependencies
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy only necessary files (via .dockerignore)
+COPY . .
+
+# Create non-root user
+RUN adduser --disabled-password --no-create-home --gecos "" appuser \
+    && chown -R appuser /app
+USER appuser
+
+# Default command
+ENTRYPOINT ["python", "src/main.py"]