diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..81e3045
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,27 @@
+# Secrets — these must never end up in an image layer.
+.env
+db.env
+*.env
+!.env.example
+
+# Version control and IDE noise.
+.git
+.gitignore
+.vscode
+.idea
+
+# Local artifacts that would otherwise be copied in by COPY.
+__pycache__/
+*.py[cod]
+*.bak
+venv/
+.venv/
+db.sqlite3
+staticfiles/
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Documentation and planning, not needed at runtime.
+*.md
+LICENSE
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 1329a83..896191d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -129,6 +129,7 @@ venv/
 ENV/
 env.bak/
 venv.bak/
+db.env
 
 # Spyder project settings
 .spyderproject
@@ -161,3 +162,5 @@ cython_debug/
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
 #.idea/
 
+staticfiles/
+*.bak
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..08fd0cb
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,31 @@
+FROM python:3.11-slim
+
+# Fail fast and log straight to stdout, so `docker-compose logs` is useful.
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+# Dependencies first: this layer is cached and only rebuilt when
+# requirements.txt changes, not on every code change.
+COPY expenses_manager/requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy the Django project itself, not the repository root, so that /app is
+# the directory holding manage.py. The previous version copied the repo root
+# into /app/expenses_manager, which left manage.py and wsgi.py one level
+# deeper than the gunicorn command expected.
+COPY expenses_manager/ .
+
+# Collect static files at build time so the running container never needs to
+# write to its own filesystem. SECRET_KEY is required by settings.py when
+# DEBUG is False, but collectstatic never uses it, so a throwaway value is
+# enough — the real one comes from the environment at runtime.
+RUN SECRET_KEY=build-time-placeholder \
+    DEBUG=False \
+    ALLOWED_HOSTS=localhost \
+    python manage.py collectstatic --noinput
+
+EXPOSE 8000
+
+CMD ["gunicorn", "expenses_manager.wsgi:application", "--bind", "0.0.0.0:8000"]
\ No newline at end of file
diff --git a/expenses_manager/requirements.txt b/expenses_manager/requirements.txt
index 02e2424..28af1ba 100644
Binary files a/expenses_manager/requirements.txt and b/expenses_manager/requirements.txt differ