diff --git a/webnut-docker/.env.example b/webnut-docker/.env.example
new file mode 100644
index 0000000..187b58a
--- /dev/null
+++ b/webnut-docker/.env.example
@@ -0,0 +1,7 @@
+# Copy to .env next to docker-compose.yml; Compose loads it automatically.
+#   cp .env.example .env && chmod 0600 .env
+
+UPS_HOST=10.20.28.200
+UPS_PORT=3493
+UPS_USER=adminuser
+UPS_PASSWORD=changeme
diff --git a/webnut-docker/docker-compose.yml b/webnut-docker/docker-compose.yml
new file mode 100644
index 0000000..89fba86
--- /dev/null
+++ b/webnut-docker/docker-compose.yml
@@ -0,0 +1,20 @@
+services:
+  webnut:
+    image: teknologist/webnut
+    container_name: webnut
+    # Values come from .env alongside this file (see .env.example).
+    environment:
+      - UPS_HOST=${UPS_HOST:?set UPS_HOST in .env}
+      - UPS_PORT=${UPS_PORT:-3493}
+      - UPS_USER=${UPS_USER:?set UPS_USER in .env}
+      - UPS_PASSWORD=${UPS_PASSWORD:?set UPS_PASSWORD in .env}
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - webnut-net
+    ports:
+      - 6543:6543
+networks:
+  webnut-net:
+    external: true