diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..e4d15be8
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,45 @@
+# VCS / editor
+.git
+.gitignore
+.gitattributes
+.DS_Store
+._.DS_Store
+.direnv
+.envrc
+.env
+
+# Nix / build artifacts
+result
+result-*
+/nix/vm-data
+build
+blog/build
+sites/target
+sites/.wrangler
+.wrangler
+.bin
+out
+tmp
+patches
+*.qcow2
+
+# Generated assets — Dockerfiles rebuild or skip these
+appview/pages/static
+node_modules
+
+# Local DB / state
+*.db
+*.db-*
+*.rdb
+*.bleve
+**/*.bleve
+genjwks.out
+
+# Sensitive material — never bake into image layers
+contrib/certs/root.key
+
+# Compose / Dockerfiles themselves (not needed inside images)
+docker-compose.yml
+docker-compose.*.yml
+**/Dockerfile
+**/*.Dockerfile