diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..1391f38
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,5 @@
+# demo-app — built by Sovereign Agentic OS CI. nginx-unprivileged listens on
+# :8080 as a non-root user. Base pinned by multi-arch (OCI index) digest.
+FROM nginxinc/nginx-unprivileged:stable-alpine@sha256:458ecbec226a23120713b35945bcdf0d6e4ea5bbec60c149ce1deca5d264071b
+COPY index.html /usr/share/nginx/html/index.html
+EXPOSE 8080