diff --git a/services/draupnir-slicer/Dockerfile b/services/draupnir-slicer/Dockerfile
new file mode 100644
index 0000000..e1e0196
--- /dev/null
+++ b/services/draupnir-slicer/Dockerfile
@@ -0,0 +1,28 @@
+# OrcaSlicer CLI for the Draupnir sliceability check.
+#
+# ⚠ THIS IS A CONTAINER BECAUSE THE HOST CANNOT RUN IT, not for tidiness.
+# irv-ml1 is Debian 12 (glibc 2.36). Every OrcaSlicer release ships only an
+# Ubuntu 24.04 AppImage, which needs GLIBC_2.38 and GLIBCXX_3.4.32 — verified
+# by ldd, not assumed. That gap is not installable on Debian 12 without moving
+# the whole host to Debian 13, which is not a thing to do to a box running
+# twelve GPU and audio services in order to slice a plate.
+#
+# Reaching back to an OrcaSlicer built for Ubuntu 22.04 would work and would
+# mean pinning permanently to a stale build — the exact trap brokkr-smithy-dev
+# rejected when choosing Orca over an old PrusaSlicer tag. A container keeps
+# the slicer current AND leaves the host untouched.
+FROM ubuntu:24.04
+ARG ORCA_VERSION=2.4.2
+ARG ORCA_URL=https://github.com/OrcaSlicer/OrcaSlicer/releases/download/v2.4.2/OrcaSlicer_Linux_AppImage_Ubuntu2404_V2.4.2.AppImage
+RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends \
+      ca-certificates curl libwebkit2gtk-4.1-0 libglu1-mesa libmspack0 \
+      libsm6 libice6 libxtst6 libgtk-3-0 \
+ && rm -rf /var/lib/apt/lists/*
+# Extract once at build time: --appimage-extract-and-run re-extracts to /tmp on
+# EVERY invocation, which is wasted seconds and wasted disk per slice.
+RUN curl -sL -o /tmp/orca.AppImage "$ORCA_URL" \
+ && chmod +x /tmp/orca.AppImage \
+ && cd /opt && /tmp/orca.AppImage --appimage-extract >/dev/null \
+ && mv squashfs-root orca && rm -f /tmp/orca.AppImage
+ENV LD_LIBRARY_PATH=/opt/orca/usr/lib
+ENTRYPOINT ["/opt/orca/bin/orca-slicer"]