diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..ed3a301
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,8 @@
+FROM python:3.12-slim
+
+RUN apt-get update -qq \
+    && apt-get install -y --no-install-recommends git pandoc ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY pipelines/songs/requirements.txt /tmp/songs-requirements.txt
+RUN pip install --no-cache-dir -r /tmp/songs-requirements.txt
diff --git a/README.md b/README.md
index 53b3b9c..20e42a0 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,17 @@ One `act_runner` instance serves all pipelines. Runs on a Pi 5 (Raspberry Pi OS
 
 Container network mode: `host` — required so job containers can reach `localhost:3005` (Gitea) and resolve mDNS hostnames.
 
+### Job container image
+
+All pipelines share a single pre-built Docker image: `novoyuuparosk-wiki-runner:latest`. The `Dockerfile` is at the repo root. It bakes in system deps (git, pandoc, ca-certificates) and all pipeline Python packages so job containers start instantly with no install steps.
+
+The image is built manually on the Pi and stored in the local Docker daemon (`pull_image: false` in act_runner config). Rebuild after any change to the `Dockerfile` or a pipeline `requirements.txt`:
+
+```bash
+docker build -t novoyuuparosk-wiki-runner:latest \
+  /home/mikkeli/dev/novoyuuparosk-auto-wiki
+```
+
 ## Gitea Actions setup (cross-cutting)
 
 Secrets and variables are scoped to user `mikkeli` (no orgs on this instance), inherited by all repos under that account.