diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..2bb768c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+# multi-stage: compile inside x86_64 linux (glibc — matches the deploy
+# target; zstd/xxhash are vendored so no system dev packages are needed)
+FROM --platform=linux/amd64 debian:bookworm-slim AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends curl xz-utils ca-certificates git && rm -rf /var/lib/apt/lists/*
+RUN curl -fSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | tar xJ -C /opt
+ENV PATH=/opt/zig-x86_64-linux-0.16.0:$PATH
+WORKDIR /build
+
+# fetch dependencies first (cacheable — only changes with build.zig.zon)
+COPY build.zig build.zig.zon ./
+RUN zig build --fetch-only 2>/dev/null || true
+
+COPY .git/ .git/
+COPY src/ src/
+RUN zig build -Doptimize=ReleaseSafe -Dcpu=baseline -Dtarget=x86_64-linux-gnu
+
+FROM --platform=linux/amd64 debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /build/zig-out/bin/stream /usr/local/bin/stream
+# glibc arena fragmentation guard (docs/lessons-from-zlay.md #8);
+# helm values set it too — defense in depth
+ENV MALLOC_ARENA_MAX=4
+EXPOSE 6008
+VOLUME /data
+ENTRYPOINT ["/usr/local/bin/stream"]
diff --git a/justfile b/justfile
index e7c8fee..8716a8f 100644
--- a/justfile
+++ b/justfile
@@ -38,3 +38,19 @@ e2e:
 package:
     zig build -Doptimize=ReleaseSafe -Dtarget=x86_64-linux-gnu
     @ls -lh zig-out/bin/stream
+
+# build + push the deploy image from a FRESH CLONE — the image tag always
+# corresponds 1:1 to a pushed commit (provenance by construction; zlay's
+# dirty-tree lesson)
+publish-docker:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    TMPDIR=$(mktemp -d)
+    trap "rm -rf $TMPDIR" EXIT
+    git clone --depth 1 https://tangled.org/zat.dev/stream "$TMPDIR"
+    cd "$TMPDIR"
+    TAG=$(git rev-parse --short HEAD)
+    IMAGE="atcr.io/zat.dev/stream:${TAG}"
+    docker build --platform linux/amd64 -t "${IMAGE}" .
+    ATCR_AUTO_AUTH=1 docker push "${IMAGE}"
+    echo "==> pushed ${IMAGE}"