diff --git a/frontend/Dockerfile b/frontend/Dockerfile
new file mode 100644
index 0000000..7c05796
--- /dev/null
+++ b/frontend/Dockerfile
@@ -0,0 +1,26 @@
+FROM node:22-alpine AS builder
+
+ARG VITE_KEYCLOAK_URL
+ARG VITE_KEYCLOAK_REALM
+ARG VITE_KEYCLOAK_CLIENT_ID
+ENV VITE_KEYCLOAK_URL=$VITE_KEYCLOAK_URL
+ENV VITE_KEYCLOAK_REALM=$VITE_KEYCLOAK_REALM
+ENV VITE_KEYCLOAK_CLIENT_ID=$VITE_KEYCLOAK_CLIENT_ID
+
+WORKDIR /app
+COPY package*.json ./
+RUN npm install
+
+# CACHE_BUST is changed per-generation by the orchestrator so that Docker
+# cannot reuse a stale cached build layer after repo content changes.
+ARG CACHE_BUST=initial
+ENV CACHE_BUST=$CACHE_BUST
+
+COPY . .
+RUN npm run build
+
+FROM nginx:alpine
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=builder /app/dist /usr/share/nginx/html
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]