diff --git a/.gitignore b/.gitignore
index c1cdd55..5afd3f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,4 @@
 /target
-Rocket.toml
+docker-compose.yml
+db/password.txt
+
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..775490c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,68 @@
+# syntax=docker/dockerfile:1
+
+# Comments are provided throughout this file to help you get started.
+# If you need more help, visit the Dockerfile reference guide at
+# https://docs.docker.com/engine/reference/builder/
+
+################################################################################
+# Create a stage for building the application.
+
+ARG RUST_VERSION=1.74.0
+ARG APP_NAME=fossil
+FROM rust:${RUST_VERSION}-slim-bullseye AS build
+ARG APP_NAME
+WORKDIR /app
+
+# Build the application.
+# Leverage a cache mount to /usr/local/cargo/registry/
+# for downloaded dependencies and a cache mount to /app/target/ for 
+# compiled dependencies which will speed up subsequent builds.
+# Leverage a bind mount to the src directory to avoid having to copy the
+# source code into the container. Once built, copy the executable to an
+# output directory before the cache mounted /app/target is unmounted.
+RUN --mount=type=bind,source=src,target=src \
+    --mount=type=bind,source=Cargo.toml,target=Cargo.toml \
+    --mount=type=bind,source=Cargo.lock,target=Cargo.lock \
+    --mount=type=cache,target=/app/target/ \
+    --mount=type=cache,target=/usr/local/cargo/registry/ \
+    --mount=type=bind,source=migrations,target=migrations \
+    <<EOF
+set -e
+cargo build --locked --release
+cp ./target/release/$APP_NAME /bin/server
+EOF
+
+################################################################################
+# Create a new stage for running the application that contains the minimal
+# runtime dependencies for the application. This often uses a different base
+# image from the build stage where the necessary files are copied from the build
+# stage.
+#
+# The example below uses the debian bullseye image as the foundation for    running the app.
+# By specifying the "bullseye-slim" tag, it will also use whatever happens to    be the
+# most recent version of that tag when you build your Dockerfile. If
+# reproducability is important, consider using a digest
+# (e.g.,    debian@sha256:ac707220fbd7b67fc19b112cee8170b41a9e97f703f588b2cdbbcdcecdd8af57).
+FROM debian:bullseye-slim AS final
+
+# Create a non-privileged user that the app will run under.
+# See https://docs.docker.com/develop/develop-images/dockerfile_best-practices/   #user
+ARG UID=10001
+RUN adduser \
+    --disabled-password \
+    --gecos "" \
+    --home "/nonexistent" \
+    --shell "/sbin/nologin" \
+    --no-create-home \
+    --uid "${UID}" \
+    appuser
+USER appuser
+
+# Copy the executable from the "build" stage.
+COPY --from=build /bin/server /bin/
+
+# Expose the port that the application listens on.
+EXPOSE 8000
+
+# What the container should run when it is started.
+CMD ["/bin/server"]
diff --git a/README.md b/README.md
index c166617..fe56121 100644
--- a/README.md
+++ b/README.md
@@ -2,4 +2,8 @@
 
 Free and Open Source Software - Library
 
-yeah yeah there's no i in the name, i just wanted the acronym to be an actual word
\ No newline at end of file
+yeah yeah there's no i in the name, i just wanted the acronym to be an actual word
+
+setup: remove .example from `docker-compose.yml.example` and `db/password.txt.example`
+\nfill out those files with the correct values
+\nrun `docker compose build` to build it, `docker compose run` to run, and `docker compose run -d` to run it in the background
diff --git a/db/password.txt.example b/db/password.txt.example
new file mode 100644
index 0000000..9a983db
--- /dev/null
+++ b/db/password.txt.example
@@ -0,0 +1 @@
+password goes here!!!
diff --git a/docker-compose.yml.example b/docker-compose.yml.example
new file mode 100644
index 0000000..0cf30b4
--- /dev/null
+++ b/docker-compose.yml.example
@@ -0,0 +1,57 @@
+# Comments are provided throughout this file to help you get started.
+# If you need more help, visit the Docker compose reference guide at
+# https://docs.docker.com/compose/compose-file/
+
+# Here the instructions define your application as a service called "server".
+# This service is built from the Dockerfile in the current directory.
+# You can add other services your application may depend on here, such as a
+# database or a cache. For examples, see the Awesome Compose repository:
+# https://github.com/docker/awesome-compose
+services:
+  server:
+    build:
+      context: .
+      target: final
+    ports:
+      - 8000:8000
+    environment:
+      - PG_DBNAME=example
+      - PG_HOST=db
+      - PG_USER=postgres
+      - PG_PASSWORD=mysecretpassword
+      - ADDRESS=0.0.0.0:8000
+      - RUST_LOG=debug
+
+      - ROCKET_SECRET_KEY="openssl rand -base64 32"
+# The commented out section below is an example of how to define a PostgreSQL
+# database that your application can use. `depends_on` tells Docker Compose to
+# start the database before your application. The `db-data` volume persists the
+# database data between container restarts. The `db-password` secret is used
+# to set the database password. You must create `db/password.txt` and add
+# a password of your choosing to it before running `docker compose up`.
+    depends_on:
+      db:
+        condition: service_healthy
+  db:
+    image: postgres
+    restart: always
+    user: postgres
+    secrets:
+      - db-password
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=example
+      - POSTGRES_PASSWORD_FILE=/run/secrets/db-password
+    expose:
+      - 5432
+    healthcheck:
+      test: [ "CMD", "pg_isready" ]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+volumes:
+  db-data:
+secrets:
+  db-password:
+    file: db/password.txt
diff --git a/src/main.rs b/src/main.rs
index e7f0d9f..cdc81ba 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,5 +1,3 @@
-#![feature(proc_macro_hygiene, decl_macro)]
-
 use std::fs;
 #[macro_use]
 extern crate rocket;
@@ -70,7 +68,7 @@ async fn logout(cookies: &CookieJar<'_>) -> &'static str {
 async fn main() {
     let _rocket = rocket::build()
         .mount("/", routes![hello, get_book, delay, login, logout])
-        .mount("/login", FileServer::from("./web"))
+        .mount("/login", FileServer::from("/srv/web"))
         .launch()
         .await
         .unwrap();