diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..0acfc7f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,26 @@
+FROM node:22-bookworm-slim
+
+WORKDIR /app
+
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Build-time NEXT_PUBLIC vars so client bundles can be configured during image build.
+ARG NEXT_PUBLIC_SUPABASE_URL
+ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
+ARG NEXT_PUBLIC_APP_URL
+
+ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL \
+    NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY \
+    NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL
+
+COPY package*.json ./
+RUN npm ci
+
+COPY . .
+RUN npm run build && npm prune --omit=dev
+
+RUN mkdir -p /app/data
+
+EXPOSE 8300
+
+CMD ["npm", "run", "start", "--", "-H", "0.0.0.0", "-p", "8300"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..6632b6b
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,43 @@
+services:
+  gantt-board:
+    image: gantt-board:latest
+    pull_policy: build
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-}
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY:-}
+        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-}
+    restart: unless-stopped
+    ports:
+      - "${APP_PORT:-8300}:8300"
+    environment:
+      NODE_ENV: production
+      NEXT_TELEMETRY_DISABLED: "1"
+      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL:-}
+      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY:-}
+      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY:-}
+      SUPABASE_URL: ${SUPABASE_URL:-}
+      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY:-}
+      SUPABASE_SECRET_KEY: ${SUPABASE_SECRET_KEY:-}
+      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-}
+      GANTT_MACHINE_TOKEN: ${GANTT_MACHINE_TOKEN:-}
+      GANTT_MACHINE_USER_ID: ${GANTT_MACHINE_USER_ID:-}
+      GANTT_MACHINE_USER_NAME: ${GANTT_MACHINE_USER_NAME:-}
+      GANTT_MACHINE_USER_EMAIL: ${GANTT_MACHINE_USER_EMAIL:-}
+      RESEND_API_KEY: ${RESEND_API_KEY:-}
+      RESEND_FROM_EMAIL: ${RESEND_FROM_EMAIL:-}
+      EMAIL_FROM: ${EMAIL_FROM:-}
+      VERCEL_URL: ${VERCEL_URL:-}
+    volumes:
+      - gantt_board_data:/app/data
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:8300/login').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 45s
+
+volumes:
+  gantt_board_data: