diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..7f19a73
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,21 @@
+.git
+.github
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+venv/
+build/
+dist/
+*.egg-info/
+tests/
+curvature_audit/
+pde_audit/
+archive/
+ledger/
+commitments/
+*.jsonl
+*.npz
+.env
diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml
new file mode 100644
index 0000000..6d92c75
--- /dev/null
+++ b/.github/workflows/container-ci.yml
@@ -0,0 +1,67 @@
+name: Container and core CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: container-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  core-tests:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install package and test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[blake3]" pytest
+      - name: Run fast core tests
+        run: python -m pytest tests/ -m "not slow" -q
+      - name: Smoke-test installed commands
+        run: |
+          wavelock-cli --help
+          wavelock-ots --help
+          wavelock-encrypt --help
+
+  container:
+    runs-on: ubuntu-24.04
+    needs: core-tests
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build CPU image
+        run: docker build --quiet --tag wavelock-ci .
+      - name: Smoke-test image commands
+        id: container_smoke
+        shell: bash
+        run: |
+          set +e
+          {
+            echo "== wavelock-cli =="
+            docker run --rm wavelock-ci wavelock-cli --help
+            echo "== wavelock-ots =="
+            docker run --rm wavelock-ci wavelock-ots --help
+          } > container-smoke.log 2>&1
+          status=$?
+          echo "status=$status" >> "$GITHUB_OUTPUT"
+          tail -n 250 container-smoke.log
+          exit 0
+      - name: Upload container diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: wavelock-container-smoke-${{ github.sha }}
+          if-no-files-found: error
+          path: container-smoke.log
+      - name: Enforce container smoke result
+        run: test "${{ steps.container_smoke.outputs.status }}" -eq 0
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..f2d71b5
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1
+
+WORKDIR /app
+
+RUN addgroup --system wavelock \
+    && adduser --system --ingroup wavelock wavelock
+
+COPY pyproject.toml README.md ./
+COPY wavelock ./wavelock
+
+RUN python -m pip install --upgrade pip \
+    && python -m pip install ".[blake3]" \
+    && mkdir -p /app/ledger /app/commitments \
+    && chown -R wavelock:wavelock /app
+
+USER wavelock
+
+EXPOSE 9001
+VOLUME ["/app/ledger", "/app/commitments"]
+
+CMD ["wavelockd"]