diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..c1dc287
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,49 @@
+# Version control
+.git/
+.gitignore
+
+# Docs and planning
+docs/
+README*
+*.md
+
+# Tests
+tests/
+
+# Dev tooling
+.venv/
+venv/
+env/
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Secrets / local config (mounted at runtime via volume)
+.env
+*.env.local
+config.yaml
+
+# Runtime data (mounted at runtime via volume)
+playbook_cache/
+
+# Plugins (mounted at runtime via volume)
+plugins/
+
+# Deployment files not needed in image
+docker-compose.yml
+systemd/
+
+# Editor / OS
+.idea/
+.vscode/
+*.swp
+*.swo
+.DS_Store
+Thumbs.db
+
+# Python artifacts
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
diff --git a/.gitignore b/.gitignore
index 659baf5..fbe9074 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,15 +12,19 @@ dist/
 build/
 *.egg
 .eggs/
+.pytest_cache/
+.coverage
+htmlcov/
 
 # Virtual environments
 .venv/
 venv/
 env/
 
-# Environment / secrets
+# Secrets / local config (use config.example.yaml as template)
 .env
 *.env.local
+config.yaml
 
 # Database
 *.db
@@ -40,11 +44,5 @@ Thumbs.db
 *.swp
 *.swo
 
-# Alembic (generated, not secrets — keep migrations in VCS but exclude caches)
-# (nothing to exclude here by default)
-
-# Docker
-.dockerignore
-
 # Playbook cache (runtime data)
 playbook_cache/
diff --git a/Dockerfile b/Dockerfile
index 85fa594..72dc702 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,9 +3,9 @@ FROM python:3.11-slim
 WORKDIR /app
 
 COPY pyproject.toml .
-RUN pip install --no-cache-dir -e .
-
 COPY fablednetmon/ fablednetmon/
+RUN pip install --no-cache-dir .
+
 COPY alembic.ini .
 
 # Runtime directories