diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..33155af
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+*
+!go.mod
+!*.go
+!web
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..0c42fcf
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,17 @@
+FROM golang:1.26-alpine AS build
+WORKDIR /src
+COPY go.mod ./
+COPY *.go ./
+COPY web ./web
+RUN CGO_ENABLED=0 go test ./... \
+ && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /codenavigator .
+
+FROM alpine:3.22
+# git is needed at runtime to clone GitHub repositories.
+RUN apk add --no-cache git ca-certificates && adduser -D -H app
+COPY --from=build /codenavigator /usr/local/bin/codenavigator
+USER app
+ENV PORT=4177
+EXPOSE 4177
+HEALTHCHECK CMD wget -qO- http://127.0.0.1:$PORT/api/health || exit 1
+ENTRYPOINT ["codenavigator"]
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..40a819f
--- /dev/null
+++ b/README.md
@@ -0,0 +1,24 @@
+# CodeNavigator
+
+A single binary that serves the WebGL frontend and the
+indexing API (jobs, SSE progress, snapshots, search, source) on one origin.
+No dependencies beyond the Go standard library.
+
+```bash
+go run .                 # http://127.0.0.1:4177
+go test -race ./...
+go test -run x -bench Index   # indexes $CODENAV_BENCH_DIR (default: Go's stdlib source)
+./build.sh [tag]         # Docker image, tests run during the build
+docker run --rm -p 4177:4177 codenavigator:latest
+```
+
+Configuration: `PORT` (default `4177`, or `--port`), `CORS_ORIGIN` (default `*`).
+`git` must be on `PATH` to load GitHub repositories (the image includes it).
+
+The browser frontend in `web/` is plain JavaScript (it has to run in the browser) and
+is embedded into the binary; `web/config.js` points it at the same origin.
+
+Notes:
+- `GET /` serves the frontend instead of a JSON service description.
+- Search queries are percent-decoded properly.
+- `.gitignore` support covers standard globs but not global excludes or `.git/info/exclude`.
diff --git a/build.sh b/build.sh
new file mode 100755
index 0000000..4e36558
--- /dev/null
+++ b/build.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+# Builds the CodeNavigator Docker image (tests run inside the build).
+# Usage: ./build.sh [image-tag]    default tag: codenavigator:latest
+set -eu
+cd "$(dirname "$0")"
+tag="${1:-codenavigator:latest}"
+docker build -t "$tag" .
+echo "Built $tag. Run: docker run --rm -p 4177:4177 $tag"