diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..5414d56
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,3 @@
+.git
+node_modules
+.DS_Store
diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
new file mode 100644
index 0000000..aca7a51
--- /dev/null
+++ b/.gitea/workflows/check.yml
@@ -0,0 +1,9 @@
+name: check
+on: [push]
+jobs:
+    check:
+        runs-on: ubuntu-latest
+        steps:
+            # actions/checkout v4.2.2, 2026-02-22
+            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+            - run: docker build .
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7b0f64a
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,22 @@
+# syntax=docker/dockerfile:1
+
+# golang:1.24-alpine, 2025-02-28
+FROM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191
+
+# Install system dependencies: Node.js, npm, make, git
+RUN apk add --no-cache nodejs npm make git
+
+# Install golangci-lint at a pinned commit hash
+# golangci-lint v2.10.1 (2025-02-17), commit 5d1e709b7be35cb2025444e19de266b056b7b7ee
+RUN GOBIN=/usr/local/bin go install \
+    github.com/golangci/golangci-lint/cmd/golangci-lint@5d1e709b7be35cb2025444e19de266b056b7b7ee
+
+WORKDIR /app
+
+COPY . .
+
+# Install frontend dependencies
+RUN cd frontend && npm ci
+
+# Run all checks — build fails if the branch is not green
+RUN make check