diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..8d7474e
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,19 @@
+# Mirrors .gitignore: ignore everything, then allow what the build needs.
+# Without this the context carries target/ (gigabytes of host-built
+# artifacts, compiled against the wrong toolchain) and cache/ into COPY . .
+*
+
+!Cargo.lock
+!Cargo.toml
+
+# Source
+!src/
+!src/**
+
+# Static assets
+!public/
+!public/**
+
+# Configuration template
+!config/
+!config/teapot.example.toml
diff --git a/.gitignore b/.gitignore
index dbee8e8..05aa06a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 *
 
 # Track project files
+!.dockerignore
 !.editorconfig
 !.envrc
 !.gitignore