diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..1e4bdf7de
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,8 @@
+.git
+.gradle
+build
+out
+generated
+target
+node_modules
+client-rest/dist
diff --git a/.gitignore b/.gitignore
index dba581d73..0de387f16 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,9 +11,6 @@ env.secrets
 distributions/*/resources/
 
 #**/src/main/resources/settings/*.yaml
-# Dockerfile is generated each time we run build.sh
-Dockerfile
-
 # compiled output
 build/
 out/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 000000000..88c3d28d5
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+# Runs the Java/Gradle build and test suite with no local JDK install.
+#
+# Source is bind-mounted at `docker run` time -- this image is not rebuilt
+# per code change. Gradle 6.9.2 (pulled by the wrapper regardless of this
+# image's bundled Gradle version) can't parse Java 17 bytecode when
+# compiling build.gradle/settings.gradle, so the JDK here is pinned to 11.
+#
+# The gradle:* image's default GRADLE_USER_HOME is /home/gradle/.gradle --
+# mount a named volume there to cache resolved dependencies across runs:
+#
+#   docker build -t datatransferproject/dev .
+#   docker run --rm -v "$PWD":/workspace -v gradle-cache:/home/gradle/.gradle datatransferproject/dev
+FROM gradle:8.10.2-jdk11
+
+WORKDIR /workspace
+
+ENTRYPOINT ["./gradlew"]
+CMD ["--no-daemon", "check"]
diff --git a/Documentation/Developer.md b/Documentation/Developer.md
index 3fbd7d918..cf42a115d 100644
--- a/Documentation/Developer.md
+++ b/Documentation/Developer.md
@@ -79,6 +79,32 @@ limitations under the License.
 
 See [Running Locally](RunningLocally.md) for instructions.
 
+## Running tests in Docker without a local JDK
+
+> **Experimental.** This workflow is new and is intended to gradually become the standard way to build
+> and test the project, eventually replacing the requirement for a local JDK. Feedback welcome.
+
+This is unrelated to the demo image built by `dockerize` above -- it's a separate, additive way to run
+the Java test suite without installing a JDK locally. The `Dockerfile` at the repo root pins
+`gradle:8.10.2-jdk11`; the source is bind-mounted at run time rather than baked into the image, so a
+rebuild isn't needed after every code change.
+
+Run the full check task against the current working tree:
+```bash
+docker compose run --rm test
+```
+
+To run a specific Gradle task or test, override the default command:
+```bash
+docker compose run --rm test test --tests SomeTest
+```
+
+The `gradle-cache` named volume (defined in `docker-compose.yml`) persists resolved dependencies across
+runs, so only the first run pays the full resolution cost.
+
+The JDK is pinned to 11 because the Gradle wrapper (6.9.2) can't parse Java 17 bytecode when compiling
+`build.gradle`/`settings.gradle` -- a `gradle:*-jdk17` image fails outright for this reason.
+
 ## Deploying in production
 
 A demo distribution for Google Cloud Platform is available at
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 000000000..8eccd7eb5
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,9 @@
+services:
+  test:
+    build: .
+    volumes:
+      - .:/workspace
+      - gradle-cache:/home/gradle/.gradle
+
+volumes:
+  gradle-cache: