diff --git a/ddk-parent/pom.xml b/ddk-parent/pom.xml
index 963fc7097..53e254dd3 100644
--- a/ddk-parent/pom.xml
+++ b/ddk-parent/pom.xml
@@ -474,6 +474,21 @@
x86_64
+
+
+
+ linux
+ aarch64
+ unix
+
+
+ 64bit_linux_aarch64
+
+ linux
+ gtk
+ aarch64
+
+
macosx
diff --git a/docker/.gitignore b/docker/.gitignore
new file mode 100644
index 000000000..2ad9294d5
--- /dev/null
+++ b/docker/.gitignore
@@ -0,0 +1 @@
+*.local
diff --git a/docker/Dockerfile b/docker/Dockerfile
new file mode 100644
index 000000000..c57f66977
--- /dev/null
+++ b/docker/Dockerfile
@@ -0,0 +1,31 @@
+FROM maven:3.9-eclipse-temurin-21
+
+# Install Xvfb and the GTK libraries required by Eclipse/SWT UI tests.
+# libgtk-3-0 covers the current DDK target platform; libgtk-4-1 is kept
+# as a fallback for newer Eclipse releases.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+ xvfb \
+ libgtk-3-0 \
+ libgtk-4-1 \
+ libglib2.0-0 \
+ libpango-1.0-0 \
+ libcairo2 \
+ libatk1.0-0 \
+ libatk-bridge2.0-0 \
+ libgdk-pixbuf2.0-0 \
+ libepoxy0 \
+ libxcomposite1 \
+ libxdamage1 \
+ libxfixes3 \
+ libxrandr2 \
+ libxrender1 \
+ libxtst6 \
+ libxi6 \
+ libgbm1 \
+ libasound2t64 \
+ libxkbcommon0 \
+ && rm -rf /var/lib/apt/lists/*
+
+# Default working directory for mounted DDK workspace.
+WORKDIR /workspace
diff --git a/docker/README.md b/docker/README.md
new file mode 100644
index 000000000..bc39fffb2
--- /dev/null
+++ b/docker/README.md
@@ -0,0 +1,57 @@
+# DDK Docker Build Environment
+
+Reusable Docker image for building and testing DSL DevKit in a Linux container.
+
+## Build the image
+
+```bash
+docker build -t ddk-build docker/
+```
+
+If your environment blocks `docker.io`, create a `docker/Dockerfile.local` (gitignored) that is identical to `Dockerfile` except for the first line, pointing `FROM` at a mirror of the base image available on your network:
+
+```dockerfile
+FROM /maven:3.9-eclipse-temurin-21
+```
+
+and build from that instead:
+
+```bash
+docker build -t ddk-build -f docker/Dockerfile.local docker/
+```
+
+## Run the full CI suite
+
+From the repository root:
+
+```bash
+docker run --rm -it --init \
+ -v "$(pwd):/workspace" \
+ -w /workspace \
+ ddk-build \
+ xvfb-run mvn clean verify checkstyle:check pmd:pmd pmd:cpd pmd:check pmd:cpd-check spotbugs:check \
+ -f ./ddk-parent/pom.xml --batch-mode --fail-at-end -T 2C
+```
+
+`--init` is required: without it `xvfb-run` runs as PID 1 inside the container, never receives Xvfb's readiness signal (PID 1 ignores signals without installed handlers), and `mvn` is never started — the container hangs silently.
+
+To cache Maven and p2 downloads between runs (each fresh container otherwise re-downloads everything), add `-v ddk-m2:/root/.m2` to the `docker run` command.
+
+> **Windows / MSYS note:** mount with an absolute Windows path (e.g. `-v "C:\dev\dsl-devkit:/workspace"`) and set `MSYS_NO_PATHCONV=1` so Docker receives Unix-style container paths such as `/workspace` instead of translated Windows paths.
+
+> **Git worktree note:** mount a full clone, not a linked worktree. A worktree's `.git` file points at the parent clone outside the mount, so Tycho's `build-qualifier` fails with `repository not found`. If you must build from a worktree, additionally mount the parent clone's `.git` directory at the same absolute path it has on the host.
+
+## TLS-intercepting networks
+
+If the build fails to resolve Eclipse p2 or Maven repositories with `PKIX path building failed`, import your organization's CA bundle into the container's Java truststore:
+
+```bash
+docker cp ca-bundle.pem :/tmp/ca-bundle.pem
+docker exec keytool -importcert -trustcacerts -alias corporate-ca \
+ -file /tmp/ca-bundle.pem -keystore /opt/java/openjdk/lib/security/cacerts \
+ -storepass changeit -noprompt
+```
+
+## Base image
+
+- `maven:3.9-eclipse-temurin-21` (Docker Hub)