diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0631c0..41b4325 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,8 +25,7 @@ jobs:
         with:
           node-version: 22
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm gate
+      - run: pnpm gate:docker
       - name: Publish preview
         if: github.event_name == 'pull_request' || github.ref == 'refs/heads/develop'
         run: pnpx pkg-pr-new publish ./packages/roller --compact --pnpm
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..43798fb
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,14 @@
+FROM node:22-bookworm-slim
+
+ENV CI=true COREPACK_HOME=/tmp/corepack LANG=C.UTF-8 LC_ALL=C.UTF-8
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends git \
+  && rm -rf /var/lib/apt/lists/* \
+  && corepack enable \
+  && mkdir -p /workspace/.pnpm-store /workspace/node_modules /workspace/packages/roller/node_modules \
+  && chmod 0777 /workspace/.pnpm-store /workspace/node_modules /workspace/packages/roller/node_modules
+
+WORKDIR /workspace
+
+CMD ["sh", "-c", "pnpm install --frozen-lockfile && pnpm gate"]
diff --git a/README.md b/README.md
index be9530c..14fa1b1 100644
--- a/README.md
+++ b/README.md
@@ -81,6 +81,7 @@ startup.
 Work branches open pull requests against the integration branch, `develop`;
 `main` contains releases. Pull requests and pushes to `develop` publish
 installable previews through pkg.pr.new once its GitHub App is installed.
+Run `pnpm gate:docker` to execute the same containerized gate used by CI.
 
 To release, update the version and changelog on `develop`, merge it to `main`,
 tag the release as `vX.Y.Z`, and publish a matching GitHub release. The release
diff --git a/package.json b/package.json
index 14d80f2..5c259b0 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,8 @@
     "typecheck": "tsc --noEmit",
     "lint": "oxlint packages scripts",
     "test": "vitest run",
-    "gate": "node scripts/gate.mjs"
+    "gate": "node scripts/gate.mjs",
+    "gate:docker": "docker build --tag roller-gate . && docker run --rm --user \"$(id -u):$(id -g)\" --volume \"$PWD:/workspace\" --volume /workspace/.pnpm-store --volume /workspace/node_modules --volume /workspace/packages/roller/node_modules roller-gate"
   },
   "devDependencies": {
     "@deepseek-ai/dsh": "catalog:",