diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..ddaa9ab
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+target/
+worktrees/
+.git/
+.github/
+.claude/
+docs/
+web/
+*.md
+.env*
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b8b77b0
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1.7
+#
+# Image for the `maestro-registry` binary.
+#
+# Build:  docker build -t maestro-registry .
+# Run:    docker run --rm -p 8080:8080 -e MAESTRO_TOKEN=<secret> maestro-registry
+#
+# On Dokploy: point at this Dockerfile, expose port 8080 (or whatever you
+# set MAESTRO_REGISTRY_BIND_ADDR to), and set MAESTRO_TOKEN as a secret env.
+# No persistent volume is required when MAESTRO_TOKEN is provided.
+
+FROM rust:1-bookworm AS builder
+WORKDIR /build
+COPY . .
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/build/target \
+    cargo build --release -p maestro-registry \
+ && cp /build/target/release/maestro-registry /maestro-registry
+
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /maestro-registry /usr/local/bin/maestro-registry
+
+# Default to all-interfaces so Dokploy / Traefik can reach the service.
+# Override via env on the platform.
+ENV MAESTRO_REGISTRY_BIND_ADDR=0.0.0.0:8080
+EXPOSE 8080
+
+ENTRYPOINT ["/usr/local/bin/maestro-registry"]