diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..f4bdf33d7
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+# Actual layer caching is impossible due to .git, but
+# that must be included for provenance reasons.  These ignores
+# are strictly for hygenic build.
+*
+!/*.go
+!/go.*
+!/cmd/*
+!/internal/*
+!/helpers/*
+!/VERSION
+!/.git/