diff --git a/.dockerignore b/.dockerignore
index 93e7db9e..7c7312c5 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,7 +1,14 @@
 # Keep the Docker build context small. This applies to ALL services (every
 # compose service uses `context: .`), so only exclude things no build needs.
 .git
+.claude
+.vscode
 **/node_modules
 local
+homepage/
+app/
+assets/
+missions/
+super-ui/
 # Runtime log tree (bind-mounted at run time; the server image mkdir's its own).
 log
diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
new file mode 100644
index 00000000..f405b3e7
--- /dev/null
+++ b/.gitea/workflows/build.yml
@@ -0,0 +1,39 @@
+name: Build and Push Docker Image
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    container:
+      options: --cap-add=NET_ADMIN --device=/dev/net/tun
+
+    steps:
+      - name: Tailscale
+        uses: tailscale/github-action@v4
+        with:
+          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
+          ping: rose-library,gitea
+          version: latest
+          use-cache: 'false'
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker Login
+        uses: docker/login-action@v2
+        with:
+          registry: gitea.allosaurus-chromatic.ts.net
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Docker Build
+        run: |
+          docker build -t gitea.allosaurus-chromatic.ts.net/tlecommunity/server:latest . --provenance=false --platform=linux/amd64
+
+      - name: Docker Push
+        run: |
+          docker push gitea.allosaurus-chromatic.ts.net/tlecommunity/server:latest
diff --git a/.prettierignore b/.prettierignore
index 6c9ab6ff..044c2f5c 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -10,3 +10,4 @@ missions/
 node_modules/
 super-ui/
 var/www/public/starmap/js/
+.dockerignore
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..220434fd
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,58 @@
+FROM perl:5.40-bookworm
+
+ENV ANYEVENT_WEBSOCKET_TEST_SKIP_SSL=1
+
+COPY . /home/lacuna/server
+WORKDIR /home/lacuna/server
+
+# System libraries the XS dependencies link against (Debian package names).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  build-essential \
+  pkg-config \
+  git \
+  curl \
+  ca-certificates \
+  default-libmysqlclient-dev \
+  libgd-dev \
+  libexpat1-dev \
+  libxml2-dev \
+  libssl-dev \
+  zlib1g-dev \
+  libncurses-dev \
+  libmemcached-dev \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN cpanm --notest Carton
+
+# Memcached::libmemcached compiles a bundled libmemcached from source (a full
+# autotools project) and overruns cpanm's default build-phase timeout. Carton
+# wipes PERL_CPANM_OPT, so it can't pass the longer timeout through — pre-install
+# this one module into ./local with an explicit timeout (version pinned to match
+# the snapshot); carton then finds it already satisfied and skips it.
+RUN cpanm --notest -l local --build-timeout=3600 --configure-timeout=1800 \
+  Memcached::libmemcached@1.001801
+
+# With a committed cpanfile.snapshot, install strictly from it (reproducible).
+# On the very first build (no snapshot yet), resolve freely and generate one —
+# extract it with `docker cp` and commit it, then all later builds are pinned.
+RUN carton install --deployment \
+  && rm -rf /root/.cpanm /root/.perl-cpm
+
+# Carton installs into ./local — put its binaries and libs on the default
+# search paths so `plackup` / `perl` in bin/startdev.sh and the compose
+# `command:` lines resolve without needing `carton exec`.
+ENV PATH="/home/lacuna/server/local/bin:${PATH}" \
+  PERL5LIB="/home/lacuna/server/local/lib/perl5" \
+  PERLLIB="/home/lacuna/server/lib" \
+  TERM=xterm
+
+# Log tree (mirrors docker/nginx/Dockerfile's `mkdir /etc/nginx/logs`). Compose
+# bind-mounts host ./log over this at run time; creating it here means the
+# subdirs still exist when the mount is absent (bare-metal, or the test overlay
+# which redirects LACUNA_LOG_DIR elsewhere).
+RUN mkdir -p /home/lacuna/server/log/server \
+  /home/lacuna/server/log/scheduler \
+  /home/lacuna/server/log/cron \
+  /home/lacuna/server/log/deploy
+
+ENTRYPOINT ["/bin/bash", "./bin/start_lacuna.sh"]