diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..2f8c53f
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,34 @@
+# VCS / editor / docs — not needed in the image build context.
+.git
+.gitea
+.idea
+.vscode
+*.md
+LICENSE
+
+# Secrets and env files must never be baked into an image layer.
+.env
+.env.*
+
+# Local build outputs and databases.
+/pansy
+*.db
+*.db-wal
+*.db-shm
+
+# Go workspace files (pansy builds standalone; GOWORK=off).
+go.work
+go.work.sum
+
+# Frontend deps/output are rebuilt inside the image's web stage.
+web/node_modules
+web/dist
+web/.vite
+
+# The embedded web build is produced fresh in the image (web stage → embed
+# directory), so never ship stale local contents. dist.go itself is kept.
+internal/webdist/dist
+
+# Assorted local scratch.
+.playwright-mcp
+.claude
diff --git a/.gitea/workflows/build-image.yml b/.gitea/workflows/build-image.yml
new file mode 100644
index 0000000..2f53d9a
--- /dev/null
+++ b/.gitea/workflows/build-image.yml
@@ -0,0 +1,87 @@
+name: Build image
+
+# Build the single-binary image and push it to the Gitea container registry so
+# it can be deployed with Komodo. Tagging (see README for the canonical table):
+#   * main            -> :latest
+#   * any other branch -> :<branch-name>   (sanitized to valid Docker tag chars)
+#   * every build also -> :sha-<short>      (immutable, handy for pinning)
+#
+# Runs on every branch push (so branch images are always available) and can be
+# triggered manually. A push to a PR branch covers the PR too, so there is no
+# separate pull_request trigger (avoids double builds).
+
+on:
+  push:
+    branches: ['**']
+  workflow_dispatch:
+
+concurrency:
+  group: build-image-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/pansy
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        # Untrusted values (branch name) go through env, never inline ${{ }}, so a
+        # crafted branch name can't inject shell. Check out the exact triggering
+        # commit so the sha-<short> tag matches the code that was built.
+        env:
+          REPO: ${{ github.repository }}
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+          GIT_TOKEN: ${{ github.token }}
+        run: |
+          git init -q .
+          git remote add origin "https://token:${GIT_TOKEN}@gitea.stevedudenhoeffer.com/${REPO}.git"
+          git fetch -q --depth=1 origin "$SHA" || git fetch -q --depth=1 origin "$REF_NAME"
+          git checkout -q FETCH_HEAD
+
+      - name: Set up Docker Buildx
+        # Check first so a genuine create failure surfaces (rather than being
+        # hidden behind a swallowed "already exists").
+        run: |
+          docker buildx inspect pansy-builder >/dev/null 2>&1 \
+            || docker buildx create --name pansy-builder --driver docker-container
+          docker buildx use pansy-builder
+
+      - name: Log in to Gitea registry
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
+
+      - name: Build and push (linux/amd64)
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          SHA: ${{ github.sha }}
+        run: |
+          SHA_SHORT=$(echo "$SHA" | cut -c1-7)
+
+          if [ "$REF_NAME" = "main" ]; then
+            PRIMARY="latest"
+          else
+            # Normalize the branch name to valid Docker tag chars [a-zA-Z0-9._-].
+            PRIMARY=$(echo "$REF_NAME" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^[-.]*//; s/-*$//')
+            # A non-main branch must never clobber :latest, and the tag can't be empty.
+            [ "$PRIMARY" = "latest" ] && PRIMARY="branch-latest"
+            [ -z "$PRIMARY" ] && PRIMARY="branch-${SHA_SHORT}"
+          fi
+
+          # Build the tag flags as an array so no word-splitting/quoting surprises.
+          TAGS=(--tag "${IMAGE_NAME}:${PRIMARY}" --tag "${IMAGE_NAME}:sha-${SHA_SHORT}")
+          echo "Building ${IMAGE_NAME}:${PRIMARY} and ${IMAGE_NAME}:sha-${SHA_SHORT}"
+
+          docker buildx build \
+            --push \
+            --platform linux/amd64 \
+            "${TAGS[@]}" \
+            --build-arg "BUILD_COMMIT=${SHA}" \
+            --build-arg "BUILD_BRANCH=${REF_NAME}" \
+            --build-arg "BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
+            --file ./Dockerfile \
+            .
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..073c8db
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,62 @@
+# syntax=docker/dockerfile:1
+#
+# pansy ships as one static binary with the web build embedded. This is a
+# three-stage build: compile the frontend, embed it into the Go binary, then
+# copy that single binary into a minimal runtime image.
+
+# ---- stage 1: build the web bundle ------------------------------------------
+FROM node:22-alpine AS web
+WORKDIR /web
+COPY web/package.json web/package-lock.json ./
+RUN --mount=type=cache,target=/root/.npm npm ci
+COPY web/ ./
+RUN npm run build
+
+# ---- stage 2: build the static Go binary (web bundle embedded) --------------
+FROM golang:1.26-alpine AS build
+# GOWORK=off matches the Makefile: pansy is a standalone module, built without
+# any parent workspace even if one leaks into the build context.
+ENV CGO_ENABLED=0 GOTOOLCHAIN=auto GOWORK=off
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+# Overlay the freshly built frontend into the embed directory before compiling
+# (//go:embed all:dist in internal/webdist).
+COPY --from=web /web/dist ./internal/webdist/dist
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go build -trimpath -ldflags "-s -w" -o /out/pansy ./cmd/pansy
+
+# ---- stage 3: minimal runtime -----------------------------------------------
+FROM alpine:3.20
+ARG BUILD_COMMIT=unknown
+ARG BUILD_BRANCH=unknown
+ARG BUILD_TIME=unknown
+LABEL org.opencontainers.image.title="pansy" \
+      org.opencontainers.image.description="Self-hostable garden planner" \
+      org.opencontainers.image.source="https://gitea.stevedudenhoeffer.com/steve/pansy" \
+      org.opencontainers.image.revision="${BUILD_COMMIT}" \
+      org.opencontainers.image.version="${BUILD_BRANCH}" \
+      org.opencontainers.image.created="${BUILD_TIME}"
+
+# ca-certificates: outbound TLS (e.g. OIDC discovery). tzdata: correct local time.
+RUN apk add --no-cache ca-certificates tzdata \
+    && adduser -D -u 10001 pansy \
+    && mkdir -p /data \
+    && chown pansy:pansy /data
+
+COPY --from=build /out/pansy /usr/local/bin/pansy
+
+USER pansy
+# The SQLite database lives on the /data volume so it survives container updates.
+ENV PANSY_PORT=8080 \
+    PANSY_DB=/data/pansy.db
+WORKDIR /data
+VOLUME /data
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+    CMD wget -q -O - "http://127.0.0.1:${PANSY_PORT}/api/v1/healthz" || exit 1
+
+ENTRYPOINT ["/usr/local/bin/pansy"]
diff --git a/README.md b/README.md
index 5711d1c..e4ffd6d 100644
--- a/README.md
+++ b/README.md
@@ -58,3 +58,42 @@ All configuration is via environment variables; every value has a default, so `.
 | `PANSY_TRUSTED_PROXIES`   | *(none)*           | Comma-separated proxy CIDRs/IPs to trust for client-IP resolution. |
 
 Auth variables are read at startup now and consumed as the auth features land (issues #4/#5).
+
+## Docker & deployment
+
+CI (`.gitea/workflows/build-image.yml`) builds the single-binary image and pushes it to the Gitea registry on every branch push:
+
+| Ref | Tag |
+| --- | --- |
+| `main` | `gitea.stevedudenhoeffer.com/steve/pansy:latest` |
+| any other branch | `gitea.stevedudenhoeffer.com/steve/pansy:<branch-name>` |
+| every build | `gitea.stevedudenhoeffer.com/steve/pansy:sha-<short>` (immutable; use to pin) |
+
+The image runs as a non-root user, serves on `:8080`, and stores the SQLite database on the `/data` volume. Run it directly:
+
+```sh
+docker run -d --name pansy \
+  -p 8080:8080 \
+  -v pansy-data:/data \
+  gitea.stevedudenhoeffer.com/steve/pansy:latest
+```
+
+Or as a Komodo/Compose stack:
+
+```yaml
+services:
+  pansy:
+    image: gitea.stevedudenhoeffer.com/steve/pansy:${PANSY_TAG:-latest}
+    ports:
+      - "8080:8080"
+    volumes:
+      - pansy-data:/data
+    environment:
+      PANSY_BASE_URL: https://pansy.example.com
+      # PANSY_OIDC_ISSUER: ...   # once auth (#5) lands
+    restart: unless-stopped
+volumes:
+  pansy-data:
+```
+
+Pin `PANSY_TAG` to a `sha-<short>` tag for reproducible deploys, or leave it at `latest` to track `main`.