diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..108c1db
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+# Exclude local build artifacts — these are regenerated inside the container
+node_modules/
+dist/
+.git/
diff --git a/.tools/docker-compose.yml b/.tools/docker-compose.yml
index 8d6b02f..4b21a38 100644
--- a/.tools/docker-compose.yml
+++ b/.tools/docker-compose.yml
@@ -1,11 +1,15 @@
-# Docker Compose for Open Ticket v4
-version: '3'
+# Docker Compose for Open Ticket
 services:
   openticket:
-    build: .
+    image: djj123dj/open-ticket:latest
     volumes:
-      - openticket:/home/container
-    restart: no
+      - config:/home/container/config
+      - database:/home/container/database
+      - plugins:/home/container/plugins
+    restart: unless-stopped
     container_name: open-ticket
+
 volumes:
-  openticket:
\ No newline at end of file
+  config:
+  database:
+  plugins:
\ No newline at end of file
diff --git a/.tools/dockerfile b/.tools/dockerfile
deleted file mode 100644
index 514203f..0000000
--- a/.tools/dockerfile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Docker File for Open Ticket v4
-# Use the official Node.js 22 image from Docker Hub
-FROM node:22-alpine
-
-# Set pterodactyl working directory inside the container
-WORKDIR /home/container
-
-# Copy package.json and package-lock.json into the container
-COPY package*.json ./
-
-# Install dependencies
-RUN npm install
-
-# Copy the rest of your app's source code into the container
-COPY . .
-
-# Run the bot from index.js
-CMD ["node", "index.js"]
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..fc1b717
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,21 @@
+# Docker File for Open Ticket
+FROM node:22-alpine
+
+# /home/container keeps Pterodactyl panel compatibility
+# chown the workdir so node user can create/remove subdirectories
+RUN mkdir -p /home/container && chown node:node /home/container
+WORKDIR /home/container
+
+# Install dependencies
+COPY --chown=node:node package*.json ./
+RUN npm install
+
+# Copy app source
+COPY --chown=node:node . .
+
+ENV NODE_ENV=production
+
+# Run as the built-in non-root node user
+USER node
+
+CMD ["node", "index.js"]
diff --git a/build-docker.sh b/build-docker.sh
new file mode 100755
index 0000000..aa9077a
--- /dev/null
+++ b/build-docker.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# build.sh — Build Open Ticket Docker images for all supported architectures.
+#
+# Usage: ./build.sh <image> [--no-push]
+#   image   Full image name, e.g. djj123dj/open-ticket
+#
+# Example: ./build.sh djj123dj/open-ticket --no-push
+
+set -euo pipefail
+
+IMAGE="${1:?Usage: ./build-docker.sh <image> [--no-push]}"
+PLATFORMS="linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64" # linux/s390x is taking too long to build, so we'll skip it for now
+VERSION=$(node -p "require('./package.json').version")
+
+# Create a multi-arch builder if it doesn't exist yet
+docker buildx inspect ot-builder &>/dev/null \
+    || docker buildx create --name ot-builder --driver docker-container --bootstrap --use
+docker buildx use ot-builder
+
+PUSH_FLAG="--push"
+[[ "${2:-}" == "--no-push" ]] && PUSH_FLAG=""
+
+docker buildx build \
+    --platform "$PLATFORMS" \
+    --tag "${IMAGE}:v${VERSION}" \
+    --tag "${IMAGE}:latest" \
+    $PUSH_FLAG \
+    .
+
+[[ -n "$PUSH_FLAG" ]] \
+    && echo "✓ Pushed ${IMAGE}:v${VERSION} and ${IMAGE}:latest" \
+    || echo "✓ Built ${IMAGE}:v${VERSION} (not pushed)"