diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..de81056c
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+# syntax=docker/dockerfile:1.2
+
+FROM mcr.microsoft.com/devcontainers/base:1-ubuntu-22.04
+
+SHELL [ "/bin/bash", "-euxo", "pipefail", "-c" ]
+
+ENV USER="vscode"
+ENV HOME="/home/${USER}"
+ENV PATH="${HOME}/.local/bin:${PATH}"
+
+USER "${USER}"
+WORKDIR "${HOME}"
+
+RUN --mount=type=bind,target=/tmp/dotfiles,rw \
+  export DOTFILES_DOCKERFILE=true; \
+  export DOTFILES_ONE_SHOT=true; \
+  /tmp/dotfiles/install.sh; \
+  sudo rm -rf /var/lib/apt/lists/*
diff --git a/home/.chezmoi.yaml.tmpl b/home/.chezmoi.yaml.tmpl
index be525b64..0d794cba 100644
--- a/home/.chezmoi.yaml.tmpl
+++ b/home/.chezmoi.yaml.tmpl
@@ -8,6 +8,7 @@
 {{- $wsl := or (env "WSL_DISTRO_NAME") (env "IS_WSL") | not | not -}}
 {{- $devcontainer := or (env "REMOTE_CONTAINERS") (env "CODESPACES") (env "VSCODE_REMOTE_CONTAINERS_SESSION") (env "GITPOD_HOST") | not | not -}}
 {{- $gnome := lookPath "gnome-shell" | not | not -}}
+{{- $dockerfile := env "DOTFILES_DOCKERFILE" | not | not -}}
 {{- $headless := or (env "SSH_CLIENT" | not | not) (not (or (env "DISPLAY") (env "WAYLAND_DISPLAY"))) -}}
 
 {{- $minimum := or $devcontainer (not $ubuntu) -}}
@@ -97,6 +98,7 @@ data:
   is_wsl: {{ $wsl }}
   is_devcontainer: {{ $minimum }}
   is_gnome: {{ $gnome }}
+  is_dockerfile: {{ $dockerfile }}
   is_headless: {{ $headless }}
 
   name: "{{ $name }}"
diff --git a/home/.chezmoiignore b/home/.chezmoiignore
index babcd57e..fa784241 100644
--- a/home/.chezmoiignore
+++ b/home/.chezmoiignore
@@ -25,6 +25,12 @@
 .chezmoiscripts/*-install-gnome-extensions.sh
 {{- end }}
 
+{{ if .is_dockerfile }}
+# The .gitconfig will be copied from the host machine by VS Code
+.gitconfig
+repos/
+{{ end }}
+
 # waiting for chezmoi to leverage .gitignore from archives:
 # https://github.com/twpayne/chezmoi/issues/1421#issuecomment-964473844
 .oh-my-zsh/cache/*
diff --git a/home/.chezmoiscripts/run_after_20-run-rootmoi.sh.tmpl b/home/.chezmoiscripts/run_after_20-run-rootmoi.sh.tmpl
index 248eaac9..63199692 100644
--- a/home/.chezmoiscripts/run_after_20-run-rootmoi.sh.tmpl
+++ b/home/.chezmoiscripts/run_after_20-run-rootmoi.sh.tmpl
@@ -50,6 +50,11 @@ for i in "${!original_args[@]}"; do
     continue
   fi
 
+  # --one-shot is not compatible with apply
+  if [[ "${original_args[i]}" == "--one-shot" ]]; then
+    continue
+  fi
+
   # Remove any positional args, as we will always use apply
   if [[ "${original_args[i]}" != "-"* ]]; then
     continue
diff --git a/root/.chezmoiignore b/root/.chezmoiignore
index ef0a623d..7321da43 100644
--- a/root/.chezmoiignore
+++ b/root/.chezmoiignore
@@ -11,3 +11,10 @@ etc/wsl.conf
 .chezmoiscripts/*-fix-permissions.sh
 .chezmoiscripts/*-restore-permissions.sh
 {{ end }}
+
+
+{{ if .is_dockerfile }}
+usr/local/bin/git-credential-manager-core
+etc/docker/
+etc/gitconfig
+{{ end }}
diff --git a/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl b/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl
index f563321f..a08b2541 100644
--- a/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl
+++ b/root/.chezmoiscripts/run_after_10-install-apt-packages.sh.tmpl
@@ -21,13 +21,15 @@ readonly wanted_packages=(
   zip
   git
   jq
-  docker-ce
   docker-ce-cli
-  containerd.io
   docker-compose-plugin
   docker-buildx-plugin
   docker-scan-plugin
+  # {{ if not .is_dockerfile }}
+  docker-ce
+  containerd.io
   asciinema
+  # {{ end }}
   # {{ if .is_gnome }}
   yaru-theme-gtk
   yaru-theme-icon
@@ -63,5 +65,10 @@ if [[ ${#missing_packages[@]} -gt 0 ]]; then
   log_task "Installing missing packages with APT: ${missing_packages[*]}"
 
   c apt update --yes
-  c apt install --yes --install-recommends "${missing_packages[@]}"
+  # {{ if .is_dockerfile }}
+  extra_args=("--no-install-recommends")
+  # {{ else }}
+  extra_args=("--install-recommends")
+  # {{ end }}
+  c apt install --yes "${extra_args[@]}" "${missing_packages[@]}"
 fi