diff --git a/Dockerfile.alpine-host b/Dockerfile.alpine-host
new file mode 100644
index 0000000..9527455
--- /dev/null
+++ b/Dockerfile.alpine-host
@@ -0,0 +1,104 @@
+# ───────────────────────────────────────────────────────────
+# Alpine Docker Host — Minimal QEMU-Bootable Image
+#
+# Purpose: Temporary Docker host running on QEMU (pc-q35-10.0)
+# atop Windows VMs in traditional deployments. Provides the
+# Docker daemon that the Ansible control node container runs on.
+#
+# What it IS:
+#   • Alpine Linux 3.20 with OpenRC (no systemd)
+#   • Docker daemon + CLI
+#   • SSH server for remote management
+#   • QEMU-bootable via build-qemu.sh
+#
+# What it is NOT:
+#   • No Ansible (deployed as a separate container)
+#   • No GCC or build tools
+#   • No Python pip packages
+#   • No quality-of-life packages
+#
+# Target size: ~200MB Docker image → ~250MB qcow2
+# ───────────────────────────────────────────────────────────
+
+FROM alpine:3.20
+
+LABEL org.opencontainers.image.title="Alpine Docker Host (QEMU)"
+LABEL org.opencontainers.image.description="Minimal Alpine Linux with Docker daemon for QEMU pc-q35-10.0. Boots in ~6s."
+
+# ── Core system (no bloat) ─────────────────────────────────
+RUN apk add --no-cache \
+    alpine-base \
+    linux-virt \
+    e2fsprogs \
+    docker \
+    docker-openrc \
+    docker-cli-compose \
+    openssh-server \
+    openssh-client \
+    dhcpcd \
+    sudo \
+    curl \
+    ca-certificates \
+    util-linux
+
+# ── OpenRC: enable just what's needed ──────────────────────
+RUN rc-update add devfs sysinit && \
+    rc-update add dmesg sysinit && \
+    rc-update add mdev sysinit && \
+    rc-update add hwdrivers sysinit && \
+    rc-update add modules boot && \
+    rc-update add sysctl boot && \
+    rc-update add bootmisc boot && \
+    rc-update add hostname boot && \
+    rc-update add networking boot && \
+    rc-update add sshd default && \
+    rc-update add dhcpcd default && \
+    rc-update add docker default
+
+# ── Serial console for QEMU -nographic ─────────────────────
+RUN echo 'ttyS0::respawn:/sbin/agetty -L 115200 ttyS0 xterm-256color' \
+    >> /etc/inittab
+
+# ── Hostname ──────────────────────────────────────────────
+RUN echo 'alpine-docker' > /etc/hostname
+
+# ── SSH configuration ─────────────────────────────────────
+RUN ssh-keygen -A && \
+    sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' \
+        /etc/ssh/sshd_config && \
+    sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/' \
+        /etc/ssh/sshd_config && \
+    echo 'UseDNS no' >> /etc/ssh/sshd_config
+
+# ── Users ─────────────────────────────────────────────────
+RUN echo 'root:ansible' | chpasswd && \
+    adduser -D ansible && \
+    echo 'ansible:ansible' | chpasswd && \
+    addgroup ansible wheel && \
+    addgroup ansible docker && \
+    echo '%wheel ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+
+# ── First-boot: expand rootfs, regenerate SSH host keys ────
+RUN printf '#!/bin/sh\n\
+ROOTDEV=$(findmnt -n -o SOURCE / 2>/dev/null || echo /dev/vda)\n\
+resize2fs "$ROOTDEV" 2>/dev/null || true\n\
+if [ ! -f /etc/ssh/.host-keys-generated ]; then\n\
+    ssh-keygen -A && touch /etc/ssh/.host-keys-generated\n\
+fi\n' \
+    > /etc/local.d/00-first-boot.start && \
+    chmod +x /etc/local.d/00-first-boot.start && \
+    rc-update add local default
+
+# ── MOTD ──────────────────────────────────────────────────
+RUN printf '\n\
+\e[1;34m╔════════════════════════════════════════════════╗\e[0m\n\
+\e[1;34m║   Alpine Docker Host — QEMU pc-q35-10.0       ║\e[0m\n\
+\e[1;34m╠════════════════════════════════════════════════╣\e[0m\n\
+\e[1;34m║  docker run ansible-node  →  IEC 62443 tests  ║\e[0m\n\
+\e[1;34m║  SSH:    ssh ansible@{ip} -p 22               ║\e[0m\n\
+\e[1;34m║  Pass:   ansible                               ║\e[0m\n\
+\e[1;34m╚════════════════════════════════════════════════╝\e[0m\n\
+' > /etc/motd
+
+WORKDIR /root
+CMD ["/sbin/init"]