diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..651a34e
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,15 @@
+# Prevent local build artifacts from leaking into Docker
+node_modules/
+frontend/node_modules/
+dist/
+frontend/dist/
+
+# Runtime data
+data/
+
+# IDE
+.vscode/
+.idea/
+
+# Binary
+dostalgia
diff --git a/Dockerfile b/Dockerfile
index 3e7f57c..f1ca9a2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,25 +1,25 @@
-# Dostalgia — Dockerized DOS game hub
+# Dostalgia — Multi-stage Docker build
 
-# ─── Build frontend ───────────────────────────────
-FROM node:20-alpine AS frontend-builder
-WORKDIR /src
+# ─── 1. Build frontend ───────────────────────────
+FROM node:20-bookworm AS frontend
+WORKDIR /build
 COPY frontend/package.json frontend/package-lock.json ./
-RUN npm install --legacy-peer-deps
+RUN npm ci --only=production 2>/dev/null || npm install --legacy-peer-deps
 COPY frontend/ ./
-RUN npm run build
+RUN npx vite build
 
-# ─── Build Go binary ─────────────────────────────
-FROM golang:1.23-alpine AS go-builder
-WORKDIR /src
+# ─── 2. Build Go binary ──────────────────────────
+FROM golang:1.23-bookworm AS gobuild
+WORKDIR /build
 COPY go.mod ./
 COPY *.go ./
-COPY --from=frontend-builder /src/dist ./frontend/dist/
+COPY --from=frontend /build/dist ./frontend/dist/
 RUN CGO_ENABLED=0 go build -o /dostalgia .
 
-# ─── Runtime ─────────────────────────────────────
-FROM alpine:3.20
-RUN apk add --no-cache ca-certificates tzdata
-COPY --from=go-builder /dostalgia /dostalgia
+# ─── 3. Runtime ──────────────────────────────────
+FROM debian:bookworm-slim
+RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends ca-certificates tzdata && rm -rf /var/lib/apt/lists/*
+COPY --from=gobuild /dostalgia /dostalgia
 VOLUME /data
 EXPOSE 8765
 ENV DOSTALGIA_DATA=/data