diff --git a/.dockerignore b/.dockerignore
index ac0ad6d..eb88ca4 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,6 +1,63 @@
+# Exclude everything that isn't strictly needed to build or run the dev images.
+# The dev Dockerfiles COPY . /app, so without this the image would bloat with
+# docs, scripts, git history, etc.
+
+# Build artifacts and caches (mounted as named volumes at runtime)
 .gradle
-.env
-.git
-frontend/node_modules
 backend/build
+frontend/dist
+frontend/coverage
+frontend/node_modules
+backend/.gradle
+
+# Test outputs
+**/build/test-results
+**/build/reports
+**/coverage
+**/.pytest_cache
+frontend/playwright-report
+frontend/test-results
+
+# Local config and secrets
+.env
+.env.*
+!.env.example
+**/application-local.yml
+
+# VCS and editor state
+.git
+.gitignore
+.gitattributes
+.github
+.forgejo
+.idea
+.vscode
+*.iml
+.DS_Store
+
+# Documentation (not needed at runtime)
+README.md
+REQUIREMENTS.md
+AGENTS.md
+CODING_GUIDELINES.md
+docs/
+
+# Ops scripts (not needed at runtime)
+scripts/
+
+# Test source dirs that aren't built into runtime artifacts
 frontend/src/__tests__
+backend/src/test
+
+# Docker-related metadata (not needed inside the running image)
+Dockerfile*
+.dockerignore
+docker-compose*.yml
+docker/
+
+# Misc
+*.log
+logs/
+tmp/
+*.bak
+*.tmp
\ No newline at end of file
diff --git a/docker-compose.dev-bindless.yml b/docker-compose.dev-bindless.yml
new file mode 100644
index 0000000..44b476c
--- /dev/null
+++ b/docker-compose.dev-bindless.yml
@@ -0,0 +1,106 @@
+# Bindless dev stack — standalone variant of docker-compose.yml.
+#
+# Why this exists as a standalone file (not an override):
+# Docker Compose merges `volumes:` by list concatenation, not by entry
+# replacement, so an override can't drop the bind mounts from the base file —
+# only append to them. A standalone file lets us redefine services with only
+# the volumes we want.
+#
+# Usage:
+#   docker compose -f docker-compose.dev-bindless.yml up -d --build
+#
+# Use this when the Docker daemon can't bind-mount the host repo correctly:
+#   - Docker-in-Docker setups (e.g. this Hermes sandbox)
+#   - rootless Docker with restricted mount paths
+#   - Some CI runners
+#
+# For normal local dev, use docker-compose.yml — it bind-mounts the repo for
+# Vite HMR and gradle bootRun hot reload.
+#
+# Trade-off vs. the bind-mounted dev compose:
+#   - The image is "frozen" at build time. Editing source on the host does not
+#     affect the running container. Edit + rebuild + restart, or run
+#     `docker compose up -d --build` after changes.
+#   - All source lives inside the image (docker/backend.Dockerfile and
+#     docker/frontend.Dockerfile COPY it in at build time).
+#
+# What you still get:
+#   - Gradle caches in named volumes (.gradle, backend/build, gradle-cache)
+#     so dependency downloads persist between `up` cycles.
+#   - Postgres data persists across `down` (via the pgdata volume).
+
+services:
+  postgres:
+    image: postgres:16
+    container_name: bilhej-postgres
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  mailpit:
+    image: ghcr.io/axllent/mailpit:v1.28
+    container_name: bilhej-mailpit
+    ports:
+      - "1025:1025"
+      - "8025:8025"
+
+  backend:
+    image: bilhej-backend-dev
+    build:
+      dockerfile: docker/backend.Dockerfile
+      context: .
+    container_name: bilhej-backend
+    ports:
+      - "8080:8080"
+    environment:
+      SPRING_PROFILES_ACTIVE: docker
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      JWT_SECRET: ${JWT_SECRET}
+      SWISH_NUMBER: ${SWISH_NUMBER}
+      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY}
+      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
+      STRIPE_PRICE_ID: ${STRIPE_PRICE_ID}
+      APP_PUBLIC_BASE_URL: ${APP_PUBLIC_BASE_URL:-http://localhost:3000}
+      MAIL_HOST: mailpit
+      MAIL_PORT: "1025"
+      MAIL_USERNAME: ""
+      MAIL_PASSWORD: ""
+      MAIL_FROM: ${MAIL_FROM:-noreply@bilhej.se}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      mailpit:
+        condition: service_started
+    volumes:
+      - backend-gradle-project:/app/.gradle
+      - backend-build:/app/backend/build
+      - gradle-cache:/root/.gradle
+
+  frontend:
+    image: bilhej-frontend-dev
+    build:
+      dockerfile: docker/frontend.Dockerfile
+      context: .
+    container_name: bilhej-frontend
+    ports:
+      - "3000:3000"
+    depends_on:
+      - backend
+
+volumes:
+  pgdata:
+  gradle-cache:
+  backend-gradle-project:
+  backend-build:
\ No newline at end of file
diff --git a/docker/backend.Dockerfile b/docker/backend.Dockerfile
index a0960cc..8745417 100644
--- a/docker/backend.Dockerfile
+++ b/docker/backend.Dockerfile
@@ -1,3 +1,15 @@
 FROM eclipse-temurin:21-jdk
 WORKDIR /app
+
+# Copy build configuration and wrapper first so this layer caches well.
+COPY gradlew settings.gradle build.gradle ./
+COPY gradle/ gradle/
+RUN chmod +x gradlew
+
+# Copy backend module. The dev compose overlays this with a host bind mount
+# for live source changes; if the bind mount is absent (DinD, CI, k8s) the
+# image is still self-contained and `gradlew :backend:bootRun` will work.
+COPY backend/ backend/
+
+EXPOSE 8080
 ENTRYPOINT ["./gradlew", ":backend:bootRun", "--no-daemon"]
diff --git a/docker/frontend.Dockerfile b/docker/frontend.Dockerfile
index a1b4d06..c68a0d0 100644
--- a/docker/frontend.Dockerfile
+++ b/docker/frontend.Dockerfile
@@ -1,7 +1,16 @@
 FROM node:24-alpine
 WORKDIR /app
+
+# Install dependencies first so this layer caches independently of source changes.
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm install
+
+# Copy the rest of the frontend. The dev compose overlays individual paths
+# (./frontend/src, ./frontend/public, ./frontend/index.html) with host bind
+# mounts for live reload; if those bind mounts are absent (DinD, CI, k8s)
+# the image is still self-contained and `npm run dev` will serve from the
+# COPY'd files.
 COPY frontend/ .
+
 EXPOSE 3000
 CMD ["npm", "run", "dev", "--", "--host", "0.0.0.0"]