diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..7469d15
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+.git
+.superpowers
+docs
+web/node_modules
+web/dist
+internal/web/dist/assets
+swarm-report
+*.md
+.env
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7e0c0fc
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,26 @@
+# syntax=docker/dockerfile:1
+
+# --- web build ---
+FROM node:22-alpine AS web
+WORKDIR /src/web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/ ./
+RUN npm run build
+
+# --- go build ---
+FROM golang:1.26.4-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+# SPA собрана на web-стадии — кладём в embed-путь ДО go build
+COPY --from=web /src/web/dist ./internal/web/dist
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/app ./cmd/server
+
+# --- runtime ---
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/app /app
+EXPOSE 8080
+USER nonroot:nonroot
+ENTRYPOINT ["/app"]