diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..1cd8a93
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,18 @@
+# Keep the build context small and never ship generated media, models, or local state.
+target/
+output/
+input/
+tmp/
+models/
+.venv-local-asset/
+.git/
+.github/
+.claude/
+*.log
+*.mp4
+*.wav
+*.onnx
+*.pt
+*.bin
+*.safetensors
+docs/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c35d7d6
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,38 @@
+# Multi-stage build for the video-editing service.
+#
+# The image contains the application + ffmpeg only. The local AI models (Piper, MusicGen, AudioLDM2,
+# moondream2) and their Python runtime are large and non-commercially licensed, so they are NOT baked in:
+# mount them read-only at runtime (e.g. -v $PWD/models:/app/models -v $PWD/.venv-local-asset:/app/.venv-local-asset)
+# and point the localpoc config at them. The REST clipping and folder workflows need no models.
+#
+# NOTE: this is a starting deployment artifact, not a certified production image — no-egress operation,
+# non-root hardening beyond the below, and vulnerability scanning are still to be validated.
+
+# --- build ---------------------------------------------------------------------------------------------
+FROM maven:3.9-eclipse-temurin-21 AS build
+WORKDIR /build
+# Cache dependencies first for faster rebuilds.
+COPY pom.xml .
+RUN mvn -B -ntp -q dependency:go-offline
+COPY src ./src
+# Tests run in CI (they need ffmpeg); skip them here to keep the image build fast and hermetic.
+RUN mvn -B -ntp -q -DskipTests package \
+    && cp target/video-editing-*.jar /build/app.jar
+
+# --- runtime -------------------------------------------------------------------------------------------
+FROM eclipse-temurin:21-jre
+# ffmpeg/ffprobe are required by the media pipeline.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+
+# Run as a non-root user.
+RUN useradd --system --create-home --uid 10001 appuser
+WORKDIR /app
+COPY --from=build /build/app.jar /app/app.jar
+USER appuser
+
+EXPOSE 8080
+# Bind to loopback by default; override SERVER_ADDRESS for a real deployment behind a proxy.
+ENV SERVER_ADDRESS=0.0.0.0
+ENTRYPOINT ["java", "-jar", "/app/app.jar"]