diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..948538e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  lint-and-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Test server
+        run: npm run test
+
+      - name: Build
+        run: npm run build
diff --git a/docker/.env.example b/docker/.env.example
new file mode 100644
index 0000000..a72b41f
--- /dev/null
+++ b/docker/.env.example
@@ -0,0 +1,4 @@
+JWT_SECRET=your-random-secret-key-min-32-chars
+APP_ENCRYPTION_KEY=your-32-char-encryption-key
+DEFAULT_ADMIN_USERNAME=admin
+DEFAULT_ADMIN_PASSWORD=admin
diff --git a/docker/Dockerfile b/docker/Dockerfile
new file mode 100644
index 0000000..29733c4
--- /dev/null
+++ b/docker/Dockerfile
@@ -0,0 +1,33 @@
+# Stage 1: Build web
+FROM node:20-alpine AS web-builder
+WORKDIR /app
+COPY package*.json ./
+COPY apps/web/package*.json ./apps/web/
+COPY apps/server/package*.json ./apps/server/
+RUN npm ci
+COPY . .
+RUN npm run build -w apps/web
+
+# Stage 2: Build server
+FROM node:20-alpine AS server-builder
+WORKDIR /app
+COPY --from=web-builder /app/node_modules ./node_modules
+COPY --from=web-builder /app/package*.json ./
+COPY --from=web-builder /app/apps/web ./apps/web
+COPY --from=web-builder /app/apps/server ./apps/server
+RUN npm run build -w apps/server
+
+# Stage 3: Production
+FROM node:20-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=server-builder /app/node_modules ./node_modules
+COPY --from=server-builder /app/package*.json ./
+COPY --from=server-builder /app/apps/server/package*.json ./apps/server/
+COPY --from=server-builder /app/apps/server/dist ./apps/server/dist
+COPY --from=server-builder /app/apps/web/dist ./apps/web/dist
+
+EXPOSE 3001
+VOLUME ["/app/apps/server/data"]
+
+CMD ["node", "apps/server/dist/index.js"]
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
new file mode 100644
index 0000000..ea5a1c6
--- /dev/null
+++ b/docker/docker-compose.yml
@@ -0,0 +1,22 @@
+version: '3.8'
+
+services:
+  vod-manager:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+    container_name: aliyun-vod-manager
+    ports:
+      - "3001:3001"
+    environment:
+      - PORT=3001
+      - NODE_ENV=production
+      - JWT_SECRET=${JWT_SECRET:-change-me-in-production}
+      - JWT_EXPIRES_IN=7d
+      - APP_ENCRYPTION_KEY=${APP_ENCRYPTION_KEY:-}
+      - DEFAULT_ADMIN_USERNAME=${DEFAULT_ADMIN_USERNAME:-admin}
+      - DEFAULT_ADMIN_PASSWORD=${DEFAULT_ADMIN_PASSWORD:-admin}
+      - DB_PATH=/app/apps/server/data/vod-manager.db
+    volumes:
+      - ./data:/app/apps/server/data
+    restart: unless-stopped
diff --git a/docs/deploy.md b/docs/deploy.md
new file mode 100644
index 0000000..48e7f7b
--- /dev/null
+++ b/docs/deploy.md
@@ -0,0 +1,89 @@
+# 部署文档
+
+## Docker Compose 部署
+
+### 1. 准备环境
+
+确保已安装 Docker 与 Docker Compose。
+
+### 2. 下载并配置
+
+```bash
+git clone https://github.com/your-org/Aliyun-VOD-Media-Library-Manager.git
+cd Aliyun-VOD-Media-Library-Manager/docker
+cp .env.example .env
+```
+
+编辑 `.env`：
+
+```env
+JWT_SECRET=your-random-secret-key-min-32-chars
+APP_ENCRYPTION_KEY=your-32-char-encryption-key
+DEFAULT_ADMIN_USERNAME=admin
+DEFAULT_ADMIN_PASSWORD=your-strong-password
+```
+
+### 3. 启动
+
+```bash
+docker-compose up -d
+```
+
+### 4. 访问
+
+打开浏览器访问 `http://<服务器IP>:3001`。
+
+### 5. 更新
+
+```bash
+docker-compose pull
+docker-compose up -d
+```
+
+## 源码部署
+
+### 环境要求
+
+- Node.js >= 20
+- npm >= 10
+
+### 步骤
+
+```bash
+npm install
+
+# 后端
+npm run dev -w apps/server
+
+# 前端（新终端）
+npm run dev -w apps/web
+```
+
+生产构建：
+
+```bash
+npm run build
+npm run start -w apps/server
+```
+
+## Nginx 反向代理（可选）
+
+```nginx
+server {
+    listen 80;
+    server_name vod.example.com;
+
+    location / {
+        proxy_pass http://127.0.0.1:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+```
+
+建议配合 Let's Encrypt 开启 HTTPS。
+
+## 数据备份
+
+SQLite 数据文件默认位于 `apps/server/data/vod-manager.db`，Docker 部署时通过 volume 映射到 `./data`。建议定期备份该文件。