diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..2ee0883
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,12 @@
+.git
+.gitignore
+.venv
+__pycache__
+*.pyc
+*.pyo
+.mypy_cache
+.pytest_cache
+.env
+credentials.json
+token.json
+data
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..cc5b727
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    UV_LINK_MODE=copy \
+    PATH="/root/.local/bin:${PATH}"
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh
+
+WORKDIR /app
+
+COPY pyproject.toml uv.lock README.md ./
+COPY app ./app
+COPY typings ./typings
+
+RUN uv sync --frozen --no-dev
+RUN mkdir -p /app/data
+
+EXPOSE 8000
+
+CMD [".venv/bin/uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/README.md b/README.md
index 2d8d101..0f94326 100644
--- a/README.md
+++ b/README.md
@@ -48,10 +48,25 @@ Edit `.env` and set:
 
 ## 4) Run
 
+### Local
+
 ```bash
 uv run uvicorn app.main:app --reload
 ```
 
+### Docker
+
+```bash
+docker compose up --build -d
+docker compose logs -f
+```
+
+Container mounts:
+
+- `./${GOOGLE_CLIENT_SECRETS_FILE}` -> `/app/${GOOGLE_CLIENT_SECRETS_FILE}` (read-only)
+- `./${GOOGLE_TOKEN_FILE}` -> `/app/${GOOGLE_TOKEN_FILE}`
+- `./data` -> `/app/data`
+
 At startup, the scheduler runs:
 
 - Gmail triage (`GMAIL_SCAN_INTERVAL_MINUTES`)
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..fb78df7
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,20 @@
+services:
+  personal-agent:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: personal-agent
+    restart: unless-stopped
+    env_file:
+      - .env
+    ports:
+      - "8000:8000"
+    volumes:
+      - ./${GOOGLE_CLIENT_SECRETS_FILE:-credentials.json}:/app/${GOOGLE_CLIENT_SECRETS_FILE:-credentials.json}:ro
+      - ./${GOOGLE_TOKEN_FILE:-token.json}:/app/${GOOGLE_TOKEN_FILE:-token.json}
+      - ./data:/app/data
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 3