diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..04e93cd
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+node_modules
+.env*
+!.env.example
+.git
+.sethetter
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..662e09e
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,2 @@
+# supply chain security!
+ignore-scripts=true
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..1d71b0b
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,12 @@
+FROM node:26-alpine
+
+WORKDIR /app
+
+COPY package.json package-lock.json tsconfig.json ./
+RUN npm ci --omit=dev
+
+COPY src/ ./src/
+
+EXPOSE 3000
+
+CMD ["node", "src/main.ts"]
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..9497bed
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,12 @@
+services:
+  bot:
+    build:
+      dockerfile: Dockerfile
+      context: .
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    environment:
+      SLACK_SIGNING_SECRET: ${SLACK_SIGNING_SECRET:?required}
+      SLACK_TOKEN: ${SLACK_BOT_TOKEN:?required}
+      SLACK_ADMIN_TOKEN: ${SLACK_ADMIN_TOKEN:?required}
diff --git a/scripts/docker.sh b/scripts/docker.sh
new file mode 100755
index 0000000..c54751f
--- /dev/null
+++ b/scripts/docker.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+docker-buildx build \
+  --tag buoy.cr/devict.org/bot:latest \
+  --platform linux/amd64,linux/arm64 \
+  --push \
+  -f Dockerfile .