diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..7fa5c80
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+node_modules
+dist
+test
+docs
+deploy
+.env
+.env.*
+!.env.example
+config.json
+*.log
+.git
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..b8eddce
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,24 @@
+# tcef-notifications — imagen de producción (fase 3, Docker Compose).
+# Multi-stage: build TS con devDeps, runtime solo con deps de producción.
+# Secretos SIEMPRE por entorno/ficheros montados — nunca dentro de la imagen.
+
+FROM node:22-alpine AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci
+COPY tsconfig.json ./
+COPY scripts ./scripts
+COPY src ./src
+RUN npm run build && npm prune --omit=dev
+
+FROM node:22-alpine
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=build --chown=node:node /app/node_modules ./node_modules
+COPY --from=build --chown=node:node /app/dist ./dist
+COPY --chown=node:node package.json ./
+USER node
+# Deuda: el servicio no expone endpoint HTTP de salud; healthcheck por proceso.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s \
+  CMD pgrep -f "dist/index.js" > /dev/null || exit 1
+CMD ["node", "--enable-source-maps", "dist/index.js"]