diff --git a/.containerignore b/.containerignore
new file mode 100644
index 0000000..dff3550
--- /dev/null
+++ b/.containerignore
@@ -0,0 +1,10 @@
+# Build context: deny everything, then allow only what the Containerfile needs.
+# Keeps the linux submodule (and example/, .gitea/, README, etc.) out of the build.
+*
+!Cargo.toml
+!Cargo.lock
+!src/
+!src/**
+!init/
+!init/**
+!kernel/config