diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..31a0560
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,45 @@
+# Docker reads .dockerignore only from the root of the build context, and every
+# service in docker/compose.yml builds with `context: ..` — this directory. The
+# copies under frontend/ and backend/ were therefore never consulted, and the
+# host's stale build outputs and node_modules were shipped into every build.
+#
+# Keep `package.json` and `bun.lock` at this root: frontend/Dockerfile copies
+# them before the workspace install.
+
+# Build outputs — regenerated inside the image.
+**/dist
+**/dist-ssr
+site
+
+# Dependencies — installed inside the image, and the host copies are built for
+# the host's platform.
+**/node_modules
+**/.venv
+
+# Caches
+**/__pycache__
+**/*.pyc
+**/.mypy_cache
+**/.ruff_cache
+**/.pytest_cache
+**/.cache
+**/.vite
+**/.tanstack
+**/fluksio.egg-info
+**/.coverage
+**/htmlcov
+
+# Test artefacts
+**/playwright-report
+**/test-results
+**/screenshots
+
+# Secrets never belong in a build context. Values reach the build as ARGs and
+# the runtime as compose `environment`.
+**/.env
+**/.env.*
+!**/.env.example
+
+.git
+**/*.log
+**/.DS_Store