diff --git a/.gitignore b/.gitignore
index e5d4f0d4..c6310e25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,7 @@
 product
 # production
 /build
+.idea/
 
 # misc
 .DS_Store
diff --git a/.npmignore b/.npmignore
index 9bec212d..24e8f32f 100644
--- a/.npmignore
+++ b/.npmignore
@@ -29,32 +29,3 @@ tsconfig.json
 .next/cache/
 .next/standalone/data/
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/DOCKER.md b/DOCKER.md
new file mode 100644
index 00000000..f96f3ca0
--- /dev/null
+++ b/DOCKER.md
@@ -0,0 +1,76 @@
+# Docker
+
+This project ships with a `Dockerfile` for building and running 9Router in a container.
+
+## Build image
+
+```bash
+docker build -t 9router .
+```
+
+## Start container
+
+```bash
+docker run --rm \
+  -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" \
+  --name 9router \
+  9router
+```
+
+The app listens on port `20128` in the container.
+
+## What the volume does
+
+```bash
+-v "$HOME/.9router:/app/data"
+```
+
+This keeps your data outside the container so it survives restarts and image rebuilds.
+
+## Stop container
+
+```bash
+docker stop 9router
+```
+
+## Run in background
+
+```bash
+docker run -d \
+  -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" \
+  --name 9router \
+  9router
+```
+
+## View logs
+
+```bash
+docker logs -f 9router
+```
+
+## Optional environment variables
+
+You can override runtime env vars with `-e`.
+
+Example:
+
+```bash
+docker run --rm \
+  -p 20128:20128 \
+  -v "$HOME/.9router:/app/data" \
+  -e PORT=20128 \
+  -e HOSTNAME=0.0.0.0 \
+  -e DEBUG=true \
+  --name 9router \
+  9router
+```
+
+## Rebuild after code changes
+
+```bash
+docker build -t 9router .
+```
+
+Then restart the container.
diff --git a/Dockerfile b/Dockerfile
index 31923ce1..e060dfc1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,14 +1,20 @@
-FROM node:20-alpine AS builder
+# syntax=docker/dockerfile:1.7
+FROM oven/bun:1-alpine AS base
 WORKDIR /app
 
-COPY package*.json ./
-RUN if [ -f package-lock.json ]; then npm ci --no-audit --no-fund; else npm install --no-audit --no-fund; fi
+FROM base AS builder
+
+RUN apk add --no-cache nodejs npm python3 make g++ linux-headers
+
+COPY package.json ./
+RUN --mount=type=cache,target=/root/.npm \
+  npm install
 
 COPY . ./
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN npm run build
+RUN bun run build:bun
 
-FROM node:20-alpine AS runner
+FROM oven/bun:1-alpine AS runner
 WORKDIR /app
 
 LABEL org.opencontainers.image.title="9router"
@@ -27,13 +33,14 @@ COPY --from=builder /app/src/mitm ./src/mitm
 # Standalone node_modules may omit deps only required by the MITM child process.
 COPY --from=builder /app/node_modules/node-forge ./node_modules/node-forge
 
-RUN mkdir -p /app/data
+RUN mkdir -p /app/data && chown -R bun:bun /app
 
 # Fix permissions at runtime (handles mounted volumes)
-RUN printf '#!/bin/sh\nchown -R node:node /app/data 2>/dev/null; exec su-exec node "$@"\n' > /entrypoint.sh && chmod +x /entrypoint.sh
-RUN apk add --no-cache su-exec
+RUN apk add --no-cache su-exec && \
+  printf '#!/bin/sh\nchown -R bun:bun /app/data 2>/dev/null\nexec su-exec bun "$@"\n' > /entrypoint.sh && \
+  chmod +x /entrypoint.sh
 
 EXPOSE 20128
 
 ENTRYPOINT ["/entrypoint.sh"]
-CMD ["node", "server.js"]
+CMD ["bun", "server.js"]