diff --git a/Dockerfile.ansible b/Dockerfile.ansible
new file mode 100644
index 0000000..61ea3e5
--- /dev/null
+++ b/Dockerfile.ansible
@@ -0,0 +1,131 @@
+# ───────────────────────────────────────────────────────────
+# Ansible Control Node — Docker Image
+#
+# Purpose: Runs IEC 62443-3-3 compliance tests against
+# Windows, Cisco, VMware, MSSQL, and Linux targets.
+#
+# Deployment targets:
+#   • Kubernetes / Docker Swarm (native)
+#   • Alpine Docker Host on QEMU (docker run on Windows VMs)
+#   • Any Linux with Docker
+#
+# Integrations:
+#   • Windows       — pywinrm + kerberos → WinRM
+#   • Cisco ASA     — cisco.asa + paramiko → SSH/CLI
+#   • Cisco Catalyst— cisco.ios + netmiko → SSH/CLI
+#   • Cisco NX-OS   — cisco.nxos + ncclient → SSH/NX-API
+#   • VMware        — pyvmomi → vCenter/ESXi SOAP API
+#   • MSSQL         — pymssql → SQL Server TDS
+#   • Linux         — native SSH (built-in ansible)
+#
+# Usage:
+#   docker build -t ansible-node -f Dockerfile.ansible .
+#   docker run --rm -v $(pwd)/playbooks:/ansible/playbooks \
+#       -v $(pwd)/inventory.ini:/ansible/inventory.ini \
+#       ansible-node site.yml
+# ───────────────────────────────────────────────────────────
+
+FROM alpine:3.20
+
+LABEL org.opencontainers.image.title="Ansible Control Node"
+LABEL org.opencontainers.image.description="Ansible with collections for Windows, Cisco, VMware, MSSQL, and Linux targets"
+
+# ── Runtime + build dependencies ───────────────────────────
+RUN apk add --no-cache \
+    ansible \
+    sshpass \
+    openssh-client \
+    py3-pip \
+    python3 \
+    python3-dev \
+    gcc \
+    musl-dev \
+    openssl-dev \
+    krb5 \
+    krb5-dev \
+    libffi-dev \
+    freetds \
+    freetds-dev \
+    bash \
+    curl \
+    ca-certificates \
+    git
+
+# ── Python packages for target integrations ──────────────
+RUN pip3 install --no-cache-dir --break-system-packages \
+    'pywinrm[kerberos]>=0.4' \
+    requests-kerberos \
+    requests-ntlm \
+    paramiko>=2.7 \
+    ncclient>=0.6 \
+    netmiko>=4.0 \
+    scp \
+    pyvmomi>=8.0 \
+    requests \
+    pymssql>=2.2 \
+    jmespath>=1.0 \
+    xmltodict>=0.13 \
+    pyyaml>=6.0 \
+    cryptography>=41.0 \
+    packaging
+
+# ── Ansible collections ──────────────────────────────────
+RUN ansible-galaxy collection install \
+    ansible.windows \
+    ansible.netcommon \
+    ansible.utils \
+    cisco.asa \
+    cisco.ios \
+    cisco.nxos \
+    community.vmware \
+    community.general \
+    community.crypto \
+    microsoft.sql
+
+# ── Purge build-only dependencies ─────────────────────────
+# apk del cascades to shared deps like util-linux (mount/umount).
+# Re-add it with network access (not --no-network here).
+RUN apk del --no-network \
+    gcc \
+    musl-dev \
+    python3-dev \
+    openssl-dev \
+    krb5-dev \
+    libffi-dev \
+    freetds-dev \
+    && apk add --no-cache util-linux
+
+# ── Ansible config ────────────────────────────────────────
+RUN mkdir -p /etc/ansible && \
+    printf '[defaults]\n\
+host_key_checking = False\n\
+stdout_callback = yaml\n\
+callback_whitelist = profile_tasks\n\
+retry_files_enabled = False\n\
+inventory = /ansible/inventory/inventory.ini\n\
+\n\
+[ssh_connection]\n\
+pipelining = True\n\
+control_path = /tmp/ansible-%%h-%%p-%%r' \
+    > /etc/ansible/ansible.cfg
+
+# ── Working directory ─────────────────────────────────────
+RUN mkdir -p /ansible/playbooks /ansible/inventory
+WORKDIR /ansible
+
+# ── Default inventory (placeholder) ───────────────────────
+RUN printf '[windows]\n\
+[cisc o_asa]\n\
+[cisc o_ios]\n\
+[cisc o_nxos]\n\
+[vmware]\n\
+[mssql]\n\
+[linux]\n\
+\n\
+[all:vars]\n\
+ansible_user=ansible\n' \
+    > /ansible/inventory/inventory.ini
+
+# ── Entrypoint: run ansible-playbook by default ───────────
+ENTRYPOINT ["ansible-playbook"]
+CMD ["--help"]