diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..973f830
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,9 @@
+.git
+node_modules
+dist
+data
+tests
+*.md
+.gitlab-ci.yml
+Dockerfile
+.dockerignore
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..7334c25
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,29 @@
+stages:
+  - build
+
+# Builds the production image (see Dockerfile: bun build → dist/, served by
+# `bun src/index.ts`) and pushes it to this project's GitLab Container Registry.
+#
+#   docker run -p 3000:3000 -v whisper-data:/app/data $CI_REGISTRY_IMAGE:latest
+build-image:
+  stage: build
+  image: docker:27
+  services:
+    - docker:27-dind
+  variables:
+    DOCKER_TLS_CERTDIR: "/certs"
+    IMAGE_SHA: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
+    IMAGE_LATEST: $CI_REGISTRY_IMAGE:latest
+  before_script:
+    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
+  script:
+    - docker build --pull -t "$IMAGE_SHA" .
+    - docker push "$IMAGE_SHA"
+    # Only the default branch moves the :latest tag.
+    - |
+      if [ "$CI_COMMIT_BRANCH" = "$CI_DEFAULT_BRANCH" ]; then
+        docker tag "$IMAGE_SHA" "$IMAGE_LATEST"
+        docker push "$IMAGE_LATEST"
+      fi
+  rules:
+    - if: $CI_COMMIT_BRANCH
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..5719342
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,32 @@
+# Build stage: install all deps (build needs onnxruntime-web files from
+# node_modules) and emit the self-contained dist/ (scripts/build.ts).
+FROM oven/bun:1 AS build
+WORKDIR /app
+
+COPY package.json bun.lock bunfig.toml ./
+RUN bun install --frozen-lockfile
+
+COPY src ./src
+COPY scripts ./scripts
+RUN bun run build
+
+# Runtime stage: production deps only. src/ and scripts/ are still needed —
+# src/index.ts is the server entrypoint and imports scripts/generate-icons.
+FROM oven/bun:1 AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+ENV DB_PATH=/app/data/app.db
+
+COPY package.json bun.lock bunfig.toml ./
+RUN bun install --frozen-lockfile --production
+
+COPY src ./src
+COPY scripts ./scripts
+COPY --from=build /app/dist ./dist
+
+# SQLite lives under /app/data — mount a volume there to persist users/sessions.
+RUN mkdir -p /app/data && chown -R bun:bun /app/data
+USER bun
+
+EXPOSE 3000
+CMD ["bun", "src/index.ts"]