diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..1b8b16b
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+# Both Dockerfiles are *environment* images: neither has a single COPY or ADD,
+# because CI checks the repo out inside the container at run time and local use
+# bind-mounts it. So the build context is deliberately empty.
+#
+# Without this file `docker build .` uploads the whole tree to the daemon —
+# 32 GB here, 30 GB of it target/ — to build an image that reads none of it.
+#
+# If a Dockerfile ever does need a file from the tree, un-ignore it explicitly:
+#   *
+#   !scripts/needed-thing.sh
+*