diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..8311412
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+target/
+.git/
+.gitignore
+.idea/
+*.iml
+*.log
+README.md
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..9e46905
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+# Build stage
+FROM maven:3.9.8-eclipse-temurin-17 AS builder
+WORKDIR /app
+COPY pom.xml .
+RUN mvn -q -DskipTests dependency:go-offline
+COPY src ./src
+RUN mvn -q -DskipTests clean package
+
+# Runtime stage
+FROM eclipse-temurin:17-jre
+WORKDIR /app
+COPY --from=builder /app/target/agent-foundation-0.0.1-SNAPSHOT.jar app.jar
+
+EXPOSE 8080
+
+# Runtime env defaults (override in Jenkins/Deploy env)
+ENV JAVA_OPTS=""
+ENV SPRING_PROFILES_ACTIVE=prod
+
+ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar /app/app.jar"]
diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 0000000..ab4c87e
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,74 @@
+pipeline {
+  agent any
+
+  environment {
+    APP_NAME = 'agent-foundation'
+    IMAGE_NAME = 'your-registry/agent-foundation'
+    IMAGE_TAG = "${env.BUILD_NUMBER}"
+    CONTAINER_NAME = 'agent-foundation'
+    APP_PORT = '8080'
+  }
+
+  stages {
+    stage('Checkout') {
+      steps {
+        checkout scm
+      }
+    }
+
+    stage('Build Image') {
+      steps {
+        script {
+          sh "docker build -t ${IMAGE_NAME}:${IMAGE_TAG} -t ${IMAGE_NAME}:latest ."
+        }
+      }
+    }
+
+    stage('Push Image') {
+      when {
+        expression { return env.IMAGE_NAME?.contains('/') }
+      }
+      steps {
+        withCredentials([usernamePassword(credentialsId: 'docker-registry-cred', usernameVariable: 'DOCKER_USER', passwordVariable: 'DOCKER_PASS')]) {
+          sh 'echo "$DOCKER_PASS" | docker login -u "$DOCKER_USER" --password-stdin'
+          sh "docker push ${IMAGE_NAME}:${IMAGE_TAG}"
+          sh "docker push ${IMAGE_NAME}:latest"
+        }
+      }
+    }
+
+    stage('Deploy') {
+      steps {
+        withCredentials([
+          string(credentialsId: 'deepseek-api-key', variable: 'DEEPSEEK_API_KEY'),
+          string(credentialsId: 'wecom-corp-id', variable: 'WECOM_CORP_ID'),
+          string(credentialsId: 'wecom-agent-id', variable: 'WECOM_AGENT_ID'),
+          string(credentialsId: 'wecom-secret', variable: 'WECOM_SECRET'),
+          string(credentialsId: 'wecom-token', variable: 'WECOM_TOKEN')
+        ]) {
+          sh "docker rm -f ${CONTAINER_NAME} || true"
+          sh '''
+            docker run -d \
+              --name ${CONTAINER_NAME} \
+              -p ${APP_PORT}:8080 \
+              -e DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} \
+              -e WECOM_CORP_ID=${WECOM_CORP_ID} \
+              -e WECOM_AGENT_ID=${WECOM_AGENT_ID} \
+              -e WECOM_SECRET=${WECOM_SECRET} \
+              -e WECOM_TOKEN=${WECOM_TOKEN} \
+              ${IMAGE_NAME}:${IMAGE_TAG}
+          '''
+        }
+      }
+    }
+  }
+
+  post {
+    success {
+      echo "Deploy success: ${IMAGE_NAME}:${IMAGE_TAG}"
+    }
+    failure {
+      echo 'Pipeline failed'
+    }
+  }
+}