diff --git a/web-player/.dockerignore b/web-player/.dockerignore
new file mode 100644
index 0000000..7db544b
--- /dev/null
+++ b/web-player/.dockerignore
@@ -0,0 +1,12 @@
+node_modules
+build
+.svelte-kit
+.env
+.env.*
+!.env.example
+.git
+.github
+.claude
+.vscode
+docs
+*.md
diff --git a/web-player/Dockerfile b/web-player/Dockerfile
index 482b514..d114075 100644
--- a/web-player/Dockerfile
+++ b/web-player/Dockerfile
@@ -2,16 +2,17 @@
 FROM node:22-alpine AS build
 WORKDIR /src
 COPY package.json package-lock.json ./
-RUN npm install
+RUN npm ci
 COPY . .
-RUN npm run build
+RUN npm run build && npm prune --omit=dev
 
 FROM node:22-alpine AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
+ENV PORT=3000
 COPY --from=build /src/build ./build
 COPY --from=build /src/node_modules ./node_modules
 COPY --from=build /src/package.json ./package.json
+USER node
 EXPOSE 3000
-ENV PORT=3000
 CMD ["node", "build/index.js"]