diff --git a/.dockerignore b/.dockerignore
index 0941d462..21ce6789 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -3,6 +3,7 @@
 .pytest_cache
 .ruff_cache
 .venv
+target
 .worktrees
 benchmark/datasets
 benchmark/tb_runs
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..9523c3a9
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Build the standalone switchyard-server binary against the workspace lockfile.
+FROM rust:1.96.1-bookworm AS builder
+WORKDIR /app
+COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+COPY .cargo/ .cargo/
+COPY crates/ crates/
+RUN cargo build --release --locked --package switchyard-server
+
+# Runtime image: binary only, runs unprivileged. Mount a TOML deployment at
+# /etc/switchyard/config.toml and pass provider API keys as env vars.
+FROM debian:bookworm-slim
+RUN apt-get update \
+    && apt-get install --yes --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --system --uid 10001 switchyard
+COPY --from=builder /app/target/release/switchyard-server /usr/local/bin/switchyard-server
+USER switchyard
+EXPOSE 4000
+ENTRYPOINT ["switchyard-server"]
+CMD ["--config", "/etc/switchyard/config.toml"]