diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..9b9666c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,24 @@
+# Local credentials and VCS metadata must never enter container images
+.git/
+.github/
+.env
+.env.*
+!.env.example
+**/*.pem
+**/*.key
+.venv/
+venv/
+__pycache__/
+**/__pycache__/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+coverage_html/
+node_modules/
+dist/
+build/
+extracted_archives/
+*.log
+*.tmp