diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..1db269b
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,8 @@
+.git
+*/target/classes
+*/target/test-classes
+*/target/generated-sources
+*/target/maven-status
+*/target/surefire-reports
+ci
+.gitea
diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
deleted file mode 100644
index 3f07a47..0000000
--- a/.gitea/workflows/build.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: build
-on: [push]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    # Runner ke paas sirf do label hain (ubuntu-latest, node-22) — Java ka koi nahi.
-    # Isliye job Maven ke apne image me chalta hai: build ka environment pinned.
-    container:
-      image: maven:3.9-eclipse-temurin-21
-    steps:
-      # actions/checkout NAHI — wo ek JavaScript action hai aur use container ke andar
-      # `node` chahiye, jo maven image me nahi hai. git se clone karna seedha aur saaf hai.
-      - name: Code laao
-        run: git clone --depth 1 http://gitea:3000/abhishek/shopforge.git .
-      - name: Build aur test
-        run: mvn -B clean verify
diff --git a/.gitea/workflows/course-p13-ci.yml b/.gitea/workflows/course-p13-ci.yml
new file mode 100644
index 0000000..6f93723
--- /dev/null
+++ b/.gitea/workflows/course-p13-ci.yml
@@ -0,0 +1,47 @@
+name: course-p13-ci
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+env:
+  REGISTRY: git.ridgeserve.duckdns.org
+  IMAGE: git.ridgeserve.duckdns.org/abhishek/course-p13-shopforge
+
+jobs:
+  pipeline:
+    runs-on: ubuntu-latest
+    # Runner ke paas Java/Maven ka koi label nahi (P02 hissa 7.2). Isliye job apne
+    # image me chalta hai — aur us image me Maven ki dependency pehle se padi hai.
+    container:
+      image: course-p13-builder:nocache
+    steps:
+      # actions/checkout NAHI — wo JavaScript action hai aur use container me node chahiye.
+      # Aur `git clone` bhi nahi: wo default branch ka NAYA commit laata hai, wo nahi
+      # jiske liye ye run bana. Isliye seedha usi commit ko fetch kar rahe hain.
+      - name: Code laao
+        run: |
+          git init -q .
+          git remote add origin http://gitea:3000/abhishek/shopforge.git
+          git fetch -q --depth 1 origin "$GITHUB_SHA" || git fetch -q --depth 1 origin "$GITHUB_REF"
+          git checkout -q FETCH_HEAD
+
+      - name: Test chalao
+        run: mvn -B test
+
+      - name: Jar banao
+        run: mvn -B package -DskipTests
+
+      # Ye do step PR par nahi chalte. PR ka code abhi main par hai hi nahi —
+      # uski image banana matlab registry me kachra bharna.
+      - name: Image banao
+        if: github.event_name == 'push'
+        run: docker build -t "$IMAGE:$GITHUB_SHA" .
+
+      - name: Registry me chadhao
+        if: github.event_name == 'push'
+        run: |
+          echo "${{ secrets.COURSE_P13_REGISTRY_TOKEN }}" \
+            | docker login "$REGISTRY" -u abhishek --password-stdin
+          docker push "$IMAGE:$GITHUB_SHA"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..d3977fc
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,7 @@
+FROM eclipse-temurin:21-jre-alpine
+WORKDIR /app
+# Jar CI me pehle hi ban chuki hai aur usi par test chal chuke hain.
+# Ise yahan DOBARA mat banao — warna image me wo jar jaayegi jo kabhi test nahi hui.
+COPY shopforge-bootstrap/target/shopforge-bootstrap-0.1.0-SNAPSHOT.jar app.jar
+EXPOSE 19080
+ENTRYPOINT ["java", "-jar", "/app/app.jar"]
diff --git a/ci/builder.Dockerfile b/ci/builder.Dockerfile
new file mode 100644
index 0000000..9962f59
--- /dev/null
+++ b/ci/builder.Dockerfile
@@ -0,0 +1,17 @@
+# Do image, ek hi file se. Farak sirf DOOSRE stage ka hai - yaani cache.
+#   --target tools  ->  course-p13-builder:nocache   (thanda ~/.m2)
+#   (poora)         ->  course-p13-builder:1         (garam ~/.m2)
+
+FROM maven:3.9-eclipse-temurin-21 AS tools
+# Job ko docker ka CLIENT chahiye. Daemon runner ka apna hai aur uska socket
+# job ke container me pehle se laga hota hai - yahan sirf binary aa rahi hai.
+RUN curl -fsSL https://download.docker.com/linux/static/stable/aarch64/docker-29.8.1.tgz \
+      | tar xz -C /tmp docker/docker \
+ && mv /tmp/docker/docker /usr/local/bin/docker \
+ && rm -rf /tmp/docker
+
+FROM tools AS warm
+# Ek baar poora build chala do - maqsad ~/.m2 bharna hai, jar banana nahi.
+# `;` isliye hai `&&` nahi: seed build fail bhi ho to jitni jar utri wo reh jaayein.
+COPY . /seed
+RUN cd /seed && mvn -B -q clean verify ; rm -rf /seed