diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..9b98875
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,6 @@
+.git
+.github
+node_modules
+*.md
+workspace
+.godex
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..76f581a
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,62 @@
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
+
+ARG TARGETOS
+ARG TARGETARCH
+
+RUN apk add --no-cache git ca-certificates tzdata
+
+WORKDIR /build
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG TARGETPLATFORM
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o godex-${TARGETOS}-${TARGETARCH} ./cmd/godex
+
+FROM alpine:3.19
+
+RUN apk add --no-cache \
+    bash \
+    python3 \
+    py3-pip \
+    nodejs \
+    npm \
+    git \
+    curl \
+    wget \
+    vim \
+    nano \
+    tar \
+    gzip \
+    unzip \
+    zip \
+    htop \
+    tree \
+    jq \
+    ripgrep \
+    fd \
+    fzf \
+    make \
+    cmake \
+    gcc \
+    g++ \
+    musl-dev \
+    go \
+    rustc \
+    cargo
+
+RUN pip3 install --no-cache-dir pip --upgrade && \
+    pip3 install --no-cache-dir black flake8 pytest
+
+ENV HOME=/root
+ENV PATH=$HOME/go/bin:$PATH
+
+COPY --from=builder /build/godex-${TARGETOS}-${TARGETARCH} /usr/local/bin/godex
+RUN chmod +x /usr/local/bin/godex
+
+WORKDIR /workspace
+
+ENTRYPOINT ["godex"]
+CMD ["--wizard"]
diff --git a/README.md b/README.md
index 0a146f2..d8e08a2 100644
--- a/README.md
+++ b/README.md
@@ -268,6 +268,81 @@ go build -o godex ./cmd/godex
 ./godex
 ```
 
+## Running Securely with Docker
+
+GoDex can be run in an isolated Docker container with a pre-configured sandbox environment containing common tools (Python, Node.js, Go, Rust, etc.).
+
+### Quick Install
+
+```bash
+curl -sSL https://raw.githubusercontent.com/cheikh2shift/godex/main/install-docker.sh | bash
+```
+
+### Why Use Docker?
+
+Running GoDex in Docker provides:
+- **Isolation** - GoDex operates only within the mounted workspace directory
+- **No host pollution** - Tools and changes stay contained
+- **Consistent environment** - Same tools available regardless of host system
+- **Safety** - Test configurations without risking your host system
+
+### Manual Setup
+
+```bash
+# Download files
+curl -fsSL https://raw.githubusercontent.com/cheikh2shift/godex/main/Dockerfile -o Dockerfile
+curl -fsSL https://raw.githubusercontent.com/cheikh2shift/godex/main/docker-compose.yml -o docker-compose.yml
+
+# Create workspace directory
+mkdir -p workspace
+
+# Run
+docker compose up
+```
+
+### Usage
+
+1. **First run** - The container will launch the wizard to configure your provider:
+   ```bash
+   docker compose up
+   ```
+   Configure your Ollama/OpenRouter/etc. settings when prompted.
+
+2. **Subsequent runs** - Your config is persisted in a Docker volume:
+   ```bash
+   docker compose up
+   ```
+
+3. **Access your workspace** - The `./workspace` directory in your project is mounted at `/workspace` inside the container. Create or edit files there before running godex.
+
+4. **Custom provider config** - If you have an existing `~/.godex/providers.yaml`, copy it to the workspace:
+   ```bash
+   cp ~/.godex/providers.yaml ./workspace/providers.yaml
+   docker compose run --rm godex godex --config /workspace/providers.yaml
+   ```
+
+### Included Tools
+
+The sandbox includes:
+- Python 3, pip, pytest, black, flake8
+- Node.js, npm
+- Go, Rust (rustc, cargo)
+- Git, curl, wget
+- Build tools: make, cmake, gcc, g++
+- Utilities: htop, tree, jq, ripgrep, fd, fzf, vim, nano
+
+### Security Notes
+
+- GoDex can only access files within the `./workspace` directory (read-write)
+- Container runs as non-root user (UID 1000)
+- Most Linux capabilities dropped; only `NET_RAW` and `NET_BIND_SERVICE` allowed
+- No new privileges allowed
+- Root filesystem is read-only
+- `/tmp` and `/run` use tmpfs (memory-only, non-persistent)
+- Process and file limits enforced
+- Provider credentials are stored in the `godex-config` volume
+- Use `docker compose down -v` to completely remove all data
+
 ## Troubleshooting
 
 ### Ollama Model Not Found
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..71f67fb
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,36 @@
+services:
+  godex:
+    build:
+      context: .
+      platform: linux/amd64
+    image: godex-sandbox
+    container_name: godex
+    environment:
+      - HOME=/godex-home
+    volumes:
+      - .:/workspace
+      - godex-config:/godex-home/.godex
+    working_dir: /workspace
+    stdin_open: true
+    tty: true
+    restart: "no"
+    security_opt:
+      - no-new-privileges:true
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /run
+    user: "1000:1000"
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_RAW
+      - NET_BIND_SERVICE
+    ulimits:
+      nproc: 512
+      nofile:
+        soft: 256
+        hard: 256
+
+volumes:
+  godex-config:
diff --git a/install-docker.sh b/install-docker.sh
new file mode 100755
index 0000000..fb6e591
--- /dev/null
+++ b/install-docker.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+set -e
+
+GITHUB_REPO="https://raw.githubusercontent.com/cheikh2shift/godex/main"
+
+echo "GoDex Docker Sandbox Installer"
+echo "=============================="
+echo ""
+
+INSTALL_DIR="${1:-$HOME/godex-docker}"
+
+echo "Installing GoDex Docker tools to: $INSTALL_DIR"
+echo ""
+
+mkdir -p "$INSTALL_DIR"
+cd "$INSTALL_DIR"
+
+echo "Downloading Dockerfile..."
+curl -fsSL "${GITHUB_REPO}/Dockerfile" -o Dockerfile
+
+echo "Downloading docker-compose.yml..."
+curl -fsSL "${GITHUB_REPO}/docker-compose.yml" -o docker-compose.yml
+
+echo ""
+echo "Setup complete!"
+echo ""
+echo "To run GoDex in your project directory:"
+echo ""
+echo "  docker compose -f $INSTALL_DIR/docker-compose.yml up"
+echo ""
+echo "Or add this alias to your shell (~/.bashrc or ~/.zshrc):"
+echo ""
+echo "  alias godex='docker compose -f $INSTALL_DIR/docker-compose.yml up'"
+echo ""
+echo "This will:"
+echo "  - Build the GoDex container with Python, Node.js, Go, Rust, and more"
+echo "  - Mount your current directory as the working directory"
+echo "  - Store config in a Docker volume"
+echo ""
+echo "First run will prompt you to configure your LLM provider."
+echo ""