diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7c7068f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,46 @@
+# Stage 1: Build blueprint web output (Alpine + TeXLive)
+FROM ghcr.io/xu-cheng/texlive-full:20250401 AS builder
+
+RUN apk update && apk add --update make py3-pip git pkgconfig graphviz graphviz-dev gcc musl-dev
+
+WORKDIR /app
+
+COPY tools/ tools/
+COPY blueprint/ blueprint/
+COPY lakefile.toml lean-toolchain lake-manifest.json ./
+
+RUN git init && git config --global --add safe.directory /app
+
+RUN python3 -m venv /env && . /env/bin/activate \
+    && pip install --upgrade pip requests wheel \
+    && pip install pygraphviz \
+        --config-settings="--global-option=build_ext" \
+        --config-settings="--global-option=-L/usr/lib/graphviz/" \
+        --config-settings="--global-option=-R/usr/lib/graphviz/" \
+    && pip install -e ./tools/plastexdepgraph \
+    && pip install -e ./tools/leanblueprint
+
+RUN . /env/bin/activate && cd blueprint && leanblueprint web
+
+# Stage 2: Lightweight runtime (Debian)
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git graphviz libgraphviz-dev gcc pkg-config libc6-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY tools/ tools/
+COPY lakefile.toml lean-toolchain lake-manifest.json ./
+COPY --from=builder /app/blueprint blueprint/
+
+RUN pip install --no-cache-dir pygraphviz \
+    && pip install --no-cache-dir -e ./tools/plastexdepgraph \
+    && pip install --no-cache-dir -e ./tools/leanblueprint
+
+RUN git init && git config --global --add safe.directory /app
+
+EXPOSE 8000
+
+CMD ["leanblueprint", "serve"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..1336f05
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,22 @@
+services:
+  server:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: kip-server
+    ports:
+      - "8082:8000"
+    volumes:
+      - ./blueprint/status.yaml:/app/blueprint/status.yaml
+    restart: unless-stopped
+
+  dashboard:
+    build:
+      context: .
+      dockerfile: ui/Dockerfile
+    container_name: kip-dashboard
+    ports:
+      - "18080:8081"
+    volumes:
+      - .:/project
+    restart: unless-stopped
diff --git a/ui/Dockerfile b/ui/Dockerfile
new file mode 100644
index 0000000..c92c713
--- /dev/null
+++ b/ui/Dockerfile
@@ -0,0 +1,38 @@
+# Stage 1: Build client
+FROM node:22-slim AS client-builder
+WORKDIR /build
+COPY ui/client/package*.json ./
+RUN npm ci
+COPY ui/client/ ./
+RUN npm run build
+
+# Stage 2: Build server
+FROM node:22-slim AS server-builder
+WORKDIR /build
+COPY ui/server/package*.json ./
+RUN npm ci
+COPY ui/server/ ./
+RUN npm run build
+
+# Stage 3: Runtime
+FROM node:22-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    graphviz \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+# Production server deps (includes native better-sqlite3, compiled for this image)
+COPY ui/server/package*.json ./server/
+RUN cd server && npm ci --omit=dev
+
+# Compiled server JS
+COPY --from=server-builder /build/dist ./server/dist
+
+# Built client — must be at /app/client/dist so that
+# server/dist/index.js's `../../client/dist` resolves correctly
+COPY --from=client-builder /build/dist ./client/dist
+
+EXPOSE 8081
+
+CMD ["node", "server/dist/index.js", "--project", "/project", "--port", "8081"]