diff --git a/README.md b/README.md
index eba7161..b9ee0de 100644
--- a/README.md
+++ b/README.md
@@ -102,6 +102,35 @@ directory is loaded automatically via [dotenvy](https://crates.io/crates/dotenvy
 
 SQLite is used for storage. Migrations run automatically on server startup.
 
+## Running with Docker
+
+The Nix flake includes a Docker image built with `dockerTools`:
+
+```bash
+nix build .#brewlog-container
+docker load < result
+```
+
+Create a `docker.env` file:
+
+```env
+BREWLOG_ADMIN_USERNAME=admin
+BREWLOG_ADMIN_PASSWORD=password
+BREWLOG_OPENROUTER_API_KEY=sk-or-...
+BREWLOG_OPENROUTER_MODEL=google/gemini-3-flash-preview
+BREWLOG_FOURSQUARE_API_KEY=fsq3...
+BREWLOG_RP_ID=localhost
+BREWLOG_BIND_ADDRESS=0.0.0.0:3000
+BREWLOG_RP_ORIGIN=http://localhost:4000
+```
+
+```bash
+mkdir data
+docker run --rm -p 4000:3000 --env-file docker.env -v $PWD/data:/data brewlog:0.1.0
+```
+
+The database is stored at `/data/brewlog.db` inside the container — mount a host directory to `/data` to persist it.
+
 ## Contributing
 
 ```bash
diff --git a/flake.nix b/flake.nix
index 2943b43..b83bfdc 100644
--- a/flake.nix
+++ b/flake.nix
@@ -50,7 +50,10 @@
               src = lib.cleanSource ./.;
               cargoLock.lockFile = ./Cargo.lock;
 
-              nativeBuildInputs = [ pkgs.pkg-config pkgs.tailwindcss_4 ];
+              nativeBuildInputs = [
+                pkgs.pkg-config
+                pkgs.tailwindcss_4
+              ];
               buildInputs = [ pkgs.openssl ];
 
               preBuild = ''
@@ -66,6 +69,32 @@
                 maintainers = with lib.maintainers; [ jnsgruk ];
               };
             };
+
+            brewlog-container = pkgs.dockerTools.buildImage {
+              name = "brewlog";
+              tag = version;
+              created = "now";
+              copyToRoot = pkgs.buildEnv {
+                name = "image-root";
+                paths = [
+                  self.packages.${system}.brewlog
+                  pkgs.cacert
+                ];
+                pathsToLink = [
+                  "/bin"
+                  "/etc/ssl/certs"
+                ];
+              };
+              config = {
+                Entrypoint = [
+                  "${lib.getExe self.packages.${system}.brewlog}"
+                  "serve"
+                  "--database-url"
+                  "sqlite:///data/brewlog.db"
+                ];
+                User = "1000:1000";
+              };
+            };
           };
 
           devShells = {
@@ -75,16 +104,17 @@
               NIX_CONFIG = "experimental-features = nix-command flakes";
               RUST_SRC_PATH = "${rust}/lib/rustlib/src/rust/library";
 
-              buildInputs =
-                [ rust ]
-                ++ (with pkgs; [
-                  cargo-watch
-                  nil
-                  nixfmt
-                  sqlite
-                  sqlx-cli
-                  tailwindcss_4
-                ]);
+              buildInputs = [
+                rust
+              ]
+              ++ (with pkgs; [
+                cargo-watch
+                nil
+                nixfmt
+                sqlite
+                sqlx-cli
+                tailwindcss_4
+              ]);
             };
           };
         };