diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..1caff77
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+.git
+.arbor-cache.json
+public
+temp
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..db4d49f
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,5 @@
+# Repository guide
+
+- Use the checked-in `./arbor`; do not add Node.js, CSS frameworks, or another build step.
+- Prefer semantic HTML and existing Ivy/Lattice styles; check `STYLEREF.md` before adding custom CSS or JavaScript.
+- Do not edit generated site data or commit `public/`. Validate the production build with `docker build --platform linux/amd64 --file container/Dockerfile .`; it runs data sync and Arbor checks without modifying the checkout.
diff --git a/README.md b/README.md
index 2245bd4..c0fa4d7 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,17 @@ Opens a live-reloading dev server at `http://localhost:8080`. Changes to content
 
 ---
 
+## Production build
+
+Run the production build in a container so its generated data and output stay
+outside the checkout:
+
+```bash
+docker build --platform linux/amd64 --file container/Dockerfile .
+```
+
+---
+
 ## Content types
 
 ### Blog posts
diff --git a/container/Dockerfile b/container/Dockerfile
new file mode 100644
index 0000000..9f1d60c
--- /dev/null
+++ b/container/Dockerfile
@@ -0,0 +1,12 @@
+FROM python:3.12-slim-bookworm AS build
+
+WORKDIR /site
+COPY . .
+
+RUN bash scripts/sync-data.sh \
+    && ./arbor check \
+    && ./arbor build
+
+FROM scratch
+
+COPY --from=build /site/public/ /
diff --git a/scripts/sync-data.sh b/scripts/sync-data.sh
index 363f629..85c4189 100755
--- a/scripts/sync-data.sh
+++ b/scripts/sync-data.sh
@@ -4,7 +4,8 @@
 
 set -euo pipefail
 
-cd "$(git rev-parse --show-toplevel)"
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
 
 python3 sync-tags.py
 bash scripts/update-latest-post.sh