diff --git a/Dockerfile b/Dockerfile
index 2bc7b31..5ecc064 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,2 +1,19 @@
+# Multi-stage: build the Vite app here so CI produces an env-independent
+# image (no .env needed at build time — the backend URL is injected at
+# container start, see docker-entrypoint.d/30-frontend-config.sh).
+FROM oven/bun:1 AS build
+WORKDIR /app
+
+COPY package.json bun.lockb ./
+RUN bun install --frozen-lockfile
+
+COPY . .
+RUN bun run build
+
 FROM nginx:stable-alpine-perl
-COPY ./dist /usr/share/nginx/html
+COPY --from=build /app/dist /usr/share/nginx/html
+# nginx's entrypoint auto-runs *.sh in /docker-entrypoint.d/ on start.
+# Unaffected by mounting a custom /etc/nginx/nginx.conf (separate path).
+COPY docker-entrypoint.d/ /docker-entrypoint.d/
+RUN chmod +x /docker-entrypoint.d/*.sh
+EXPOSE 80
diff --git a/docker-compose.example.yml b/docker-compose.example.yml
new file mode 100644
index 0000000..9b9e147
--- /dev/null
+++ b/docker-compose.example.yml
@@ -0,0 +1,25 @@
+---
+# Prod run template. The backend URL is injected at container start
+# (docker-entrypoint.d/30-frontend-config.sh), so the image carries no env.
+# Set VITE_API_URL including the /api suffix, e.g.:
+#   VITE_API_URL=https://gamesapi.linuxhg.com/api
+# Either inline below or via env_file .env (environment wins if both set).
+# Traefik setups: drop ports, add your labels/networks like the existing
+# games-frontend service; custom nginx.conf mounts keep working.
+services:
+  games-frontend:
+    image: git.linuxhg.com/games-database/games-frontend:${IMAGE_TAG:-latest}
+    container_name: games-frontend
+    restart: unless-stopped
+    environment:
+      - VITE_API_URL=
+    # env_file:
+    #   - .env
+    ports:
+      - 80:80
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost/ || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s