diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..311dff3
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+.git
+.github
+.vscode
+node_modules
+dist
+coverage
+test
+assets
+*.log
+.DS_Store
+.nyc*
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d1635d3..ebd0371 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,6 +35,58 @@ jobs:
       - name: Test
         run: npm test
 
+  docker:
+    name: Docker Build & Publish
+    needs: build-lint-test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ startsWith(github.ref, 'refs/tags/v') && github.actor != 'dependabot[bot]' }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/centeredge/fakeit
+          # Keep semver tags without the leading `v` (e.g. 2.0.0, 2.0).
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}},prefix=
+            type=semver,pattern={{major}}.{{minor}},prefix=
+          flavor: |
+            latest=auto
+
+      - name: Docker build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ startsWith(github.ref, 'refs/tags/v') }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+          provenance: true
+          sbom: true
+          cache-to: type=gha,mode=max
+          cache-from: type=gha
+
   publish:
     name: Publish to NPM
     needs: build-lint-test
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..5793a3c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,29 @@
+FROM node:24-alpine AS build
+
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm ci
+
+COPY app ./app
+COPY bin ./bin
+COPY babel.config.json ./babel.config.json
+
+RUN npm run build \
+    && npm prune --omit=dev \
+    && npm cache clean --force
+
+FROM node:24-alpine AS runtime
+
+ENV NODE_ENV=production
+WORKDIR /app
+
+COPY --from=build /app/package.json /app/package-lock.json ./
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/dist ./dist
+COPY --from=build /app/bin ./bin
+
+USER node
+
+ENTRYPOINT ["node", "/app/bin/fakeit"]
+CMD ["--help"]
diff --git a/README.md b/README.md
index 17d62de..f1cda3e 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,20 @@ npm install @centeredgesoft/fakeit --save-dev
 npm install @centeredgesoft/fakeit --global
 ```
 
+## Docker
+
+Prebuilt images are published to GitHub Container Registry as [`ghcr.io/centeredge/fakeit`](https://github.com/CenterEdge/fakeit/pkgs/container/fakeit).
+
+```bash
+docker run --rm ghcr.io/centeredge/fakeit --help
+```
+
+To run against local models, mount your working directory:
+
+```bash
+docker run --rm -v "$PWD:/work" -w /work ghcr.io/centeredge/fakeit console ./models/*.yaml
+```
+
 ## CLI Usage
 
 ```bash