diff --git a/.dockerignore b/.dockerignore
index eec0f9fd..7201d77b 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -9,7 +9,6 @@ coverage.out
 /.worktrees/
 
 # Not used by the image build
-/web/
 /docs/
 /.github/
 *.md
@@ -25,3 +24,4 @@ coverage.out
 /.vscode/
 /.claude/
 **/.DS_Store
+/.git/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..23358bca
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,39 @@
+# ---- 1. frontend -----------------------------------------------------------
+FROM node:24-alpine AS frontend
+RUN corepack enable
+WORKDIR /src/web
+# Copy dependency manifest + patches first (pinned install), then the rest.
+COPY web/ ./
+RUN pnpm install --frozen-lockfile
+RUN pnpm release
+
+# ---- 2. backend ------------------------------------------------------------
+FROM golang:1.27-alpine AS backend
+RUN apk add --no-cache git ca-certificates
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+COPY --from=frontend /src/server/router/frontend/dist ./server/router/frontend/dist
+RUN CGO_ENABLED=0 GOOS=linux go build \
+      -trimpath \
+      -ldflags="-s -w -extldflags '-static'" \
+      -tags netgo,osusergo \
+      -o memos \
+      ./cmd/memos
+
+# ---- 3. runtime ------------------------------------------------------------
+FROM alpine:3.21
+RUN apk add --no-cache tzdata ca-certificates su-exec && \
+    addgroup -g 10001 -S nonroot && \
+    adduser -u 10001 -S -G nonroot -h /var/opt/memos nonroot && \
+    mkdir -p /var/opt/memos /usr/local/memos && \
+    chown -R nonroot:nonroot /var/opt/memos
+COPY --from=backend /src/memos /usr/local/memos/memos
+COPY --from=backend --chmod=755 /src/scripts/entrypoint.sh /usr/local/memos/entrypoint.sh
+USER root
+WORKDIR /var/opt/memos
+VOLUME /var/opt/memos
+ENV TZ="UTC" MEMOS_PORT="5230"
+EXPOSE 5230
+ENTRYPOINT ["/usr/local/memos/entrypoint.sh", "/usr/local/memos/memos"]