diff --git a/frontend/.dockerignore b/frontend/.dockerignore
new file mode 100644
index 0000000..bfe9c4d
--- /dev/null
+++ b/frontend/.dockerignore
@@ -0,0 +1,22 @@
+node_modules
+dist
+.vite
+coverage
+playwright-report
+test-results
+.eslintcache
+
+# Editor / OS
+.DS_Store
+.idea
+.vscode
+
+# Env (never bake into image)
+.env
+.env.*
+!.env.example
+
+# Git internals
+.git
+.gitignore
+.gitattributes
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
new file mode 100644
index 0000000..96ef1c9
--- /dev/null
+++ b/frontend/Dockerfile
@@ -0,0 +1,37 @@
+# syntax=docker/dockerfile:1.7
+
+# --- Stage 1: build --------------------------------------------------------
+FROM node:22-alpine AS build
+
+ENV CI=true \
+    npm_config_audit=false \
+    npm_config_fund=false
+
+WORKDIR /app
+
+# Reproducible install: lockfile only, no scripts at install time.
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts
+
+# App sources.
+COPY . .
+
+# Production build → /app/dist
+RUN npm run build
+
+# --- Stage 2: runtime ------------------------------------------------------
+# nginxinc/nginx-unprivileged is the upstream-maintained variant that runs
+# nginx as a non-root user out of the box (no chown gymnastics, /var/cache
+# /var/run/nginx are owned by uid 101). It already listens on 8080.
+FROM docker.io/nginxinc/nginx-unprivileged:alpine
+
+# Minimal SPA serving config: static dist + try_files SPA fallback.
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+# Static assets owned by the nginx user (uid 101 in this image).
+COPY --from=build --chown=101:101 /app/dist /usr/share/nginx/html
+
+EXPOSE 8080
+
+# Foreground nginx so the container lifecycle matches.
+CMD ["nginx", "-g", "daemon off;"]
diff --git a/frontend/nginx.conf b/frontend/nginx.conf
new file mode 100644
index 0000000..94395bb
--- /dev/null
+++ b/frontend/nginx.conf
@@ -0,0 +1,30 @@
+server {
+    listen       8080;
+    server_name  _;
+
+    root   /usr/share/nginx/html;
+    index  index.html;
+
+    # SPA routing: every unknown path falls back to index.html.
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Long-cache hashed asset bundles emitted by Vite under /assets/.
+    location /assets/ {
+        access_log off;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Health endpoint scraped by Caddy / Prometheus blackbox.
+    location = /healthz {
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+
+    # No directory listing, no server tokens.
+    autoindex off;
+    server_tokens off;
+}