diff --git a/.gitea/workflows/docker-build.yml b/.gitea/workflows/docker-build.yml
new file mode 100644
index 0000000..36bbc80
--- /dev/null
+++ b/.gitea/workflows/docker-build.yml
@@ -0,0 +1,27 @@
+name: Docker Build & Push
+on:
+  push:
+    branches: [main]
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: linux
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker Login
+        run: |
+          echo "${{ secrets.GITEATOKEN }}" | docker login git.kgessner.de --username keviin --password-stdin
+
+      - name: Build Image
+        run: |
+          docker build -t git.kgessner.de/keviin/logmaster:latest .
+          docker tag git.kgessner.de/keviin/logmaster:latest git.kgessner.de/keviin/logmaster:${GITHUB_SHA::8}
+
+      - name: Push Image
+        run: |
+          docker push git.kgessner.de/keviin/logmaster:latest
+          docker push git.kgessner.de/keviin/logmaster:${GITHUB_SHA::8}
diff --git a/Dockerfile b/Dockerfile
index 4524fc2..5164151 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,38 +1,40 @@
-FROM node:20-alpine
-
+# ── Build-Stage: TypeScript kompilieren ───────────────────────────
+FROM node:20-alpine AS builder
 WORKDIR /app
-
-# Install compression tools for bz2, xz, zstd support
-RUN apk add --no-cache bzip2 xz zstd
-
-# Copy package files and install deps
-COPY package.json package-lock.json* ./
-RUN npm ci --omit=dev 2>/dev/null || npm install --omit=dev
-
-# Copy TypeScript config and source
+COPY package*.json ./
+RUN npm ci --omit=dev && npm ci
 COPY tsconfig.server.json ./
 COPY src/server/ ./src/server/
+RUN npx tsc -p tsconfig.server.json
+
+# ── Production-Stage: Nur das Nötigste ─────────────────────────────
+FROM node:20-alpine
+WORKDIR /app
+
+# Runtime-User (nicht root)
+RUN addgroup -S logviewer && adduser -S logviewer -G logviewer
+
+# Nur production dependencies
+COPY package*.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+# Kompilierte Server-Dateien
+COPY --from=builder /app/dist-server/ ./dist-server/
+
+# Web-UI (statische Assets)
 COPY src/web/ ./src/web/
 
-# Install typescript for build, compile, then remove
-RUN npm install typescript@5.7.2 && \
-    npx tsc -p tsconfig.server.json && \
-    npm uninstall typescript
-
-# Copy sample logs
-COPY sample-logs/ ./sample-logs/
-
-# Generate sample logs
-RUN node sample-logs/generate-logs.js
-
-# Environment defaults
-ENV LOG_SOURCES=/app/sample-logs/app.log,/app/sample-logs/nginx-access.log,/app/sample-logs/syslog,/app/sample-logs/archived.log.gz
-ENV LOG_THEME=dark
-ENV LOG_REFRESH_INTERVAL=3000
-ENV LOG_TAIL_MODE=true
-ENV PORT=8080
-ENV HOST=0.0.0.0
+# Persistenz-Volume
+RUN mkdir -p /app/collector-data /app/monitor-data && \
+    chown -R logviewer:logviewer /app
 
+# Default-CMD (beide Modi aktiv)
 EXPOSE 8080
-
+ENV HOST=0.0.0.0 PORT=8080 LOG_MODE=both
+USER logviewer
 CMD ["node", "dist-server/server.js"]
+
+# Mögliche Overrides:
+# Collector:     -e LOG_MODE=collector -e COLLECTOR_UDP_PORT=5140
+# Viewer:        -e LOG_MODE=viewer -p 9090:9090
+# Monitor:       -e LOG_MODE=monitor -e MONITOR_RULES='[...]'
\ No newline at end of file