diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..a04aab4
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,18 @@
+# Keep the build context small: source only, no build output or local data.
+.git
+**/target
+
+# local rocksdb data / backups
+rocks.test
+rocks.tapbackfill
+**/*.db
+**/*.db-*
+
+# editor / OS cruft
+.DS_Store
+**/.idea
+**/.vscode
+
+# docker files themselves don't need to be in the context
+**/Dockerfile
+docker-compose.yml
diff --git a/.gitignore b/.gitignore
index 84c054d..eae1adb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /target
 local/
 rocks.test
+constellation-data
diff --git a/constellation/Dockerfile b/constellation/Dockerfile
new file mode 100644
index 0000000..be578c8
--- /dev/null
+++ b/constellation/Dockerfile
@@ -0,0 +1,41 @@
+# Multi-stage build for constellation.
+#
+# The build context must be the workspace ROOT (microcosm-rs/)
+FROM rust:1.96-bookworm AS builder
+
+# rocksdb (bundled) builds a C++ library and runs bindgen (needs libclang);
+# tungstenite's native-tls feature needs OpenSSL headers.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        clang \
+        libclang-dev \
+        build-essential \
+        libssl-dev \
+        pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY . .
+
+# Cache the cargo registry and target dir across builds. Because the target dir
+# lives in a cache mount (not the layer), copy the finished binary out in the
+# same RUN so it survives into the image.
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/app/target \
+    cargo build --release -p constellation \
+    && cp target/release/main /usr/local/bin/constellation
+
+FROM debian:12.14-slim AS runtime
+
+# ca-certificates for TLS to jetstream/tap; libssl3 for native-tls at runtime.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        libssl3 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/local/bin/constellation /usr/local/bin/constellation
+
+RUN mkdir -p /data
+VOLUME ["/data"]
+
+ENTRYPOINT ["constellation"]
+CMD ["--help"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..f603613
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,30 @@
+# Mostly used as an example to show how to run microcosm-rs projects via Docker Compose.
+# Change as needed
+services:
+  constellation:
+    build:
+      context: .
+      dockerfile: ./constellation/Dockerfile
+    container_name: constellation
+    ports:
+      - "6789:6789" # link query HTTP API
+      - "8765:8765" # prometheus metrics
+    # Saves directly to a folder on disk
+    volumes:
+      - ./constellation-data:/data
+    command:
+      - "--jetstream"
+      - "us-east-1"
+      - "--backend"
+      - "rocks"
+      - "--data"
+      - "/data"
+      - "--bind"
+      - "0.0.0.0:6789"
+      - "--collect-metrics"
+      - "--bind-metrics"
+      - "0.0.0.0:8765"
+    restart: unless-stopped
+
+volumes:
+  constellation-data: