diff --git a/auth/.dockerignore b/auth/.dockerignore
new file mode 100644
index 00000000..72546c82
--- /dev/null
+++ b/auth/.dockerignore
@@ -0,0 +1,12 @@
+Dockerfile*
+*.md
+.dockerignore
+.gitignore
+.env*
+
+# generated via sqlc
+dbc/
+# genereated via swag
+docs/
+
+# vim: ft=gitignore
diff --git a/auth/Dockerfile b/auth/Dockerfile
new file mode 100644
index 00000000..2142fb98
--- /dev/null
+++ b/auth/Dockerfile
@@ -0,0 +1,23 @@
+FROM golang:1.23 AS build
+WORKDIR /app
+
+RUN go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
+RUN go install github.com/swaggo/swag/cmd/swag@latest
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY sqlc.yaml sql ./
+RUN sqlc generate
+
+COPY . .
+RUN swag init --parseDependency
+RUN CGO_ENABLED=0 GOOS=linux go build -o /keibi
+
+FROM gcr.io/distroless/base-debian11
+WORKDIR /
+EXPOSE 4568
+USER nonroot:nonroot
+
+COPY --from=build /keibi /keibi
+CMD ["/keibi"]
diff --git a/auth/Dockerfile.dev b/auth/Dockerfile.dev
new file mode 100644
index 00000000..ab73945b
--- /dev/null
+++ b/auth/Dockerfile.dev
@@ -0,0 +1,16 @@
+FROM golang:1.23 AS build
+WORKDIR /app
+
+RUN go install github.com/bokwoon95/wgo@latest
+RUN go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
+RUN go install github.com/swaggo/swag/cmd/swag@latest
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+# COPY sqlc.yaml ./
+# COPY sql/ ./
+# RUN sqlc generate
+
+EXPOSE 4568
+CMD ["wgo", "run", "-race", "."]
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index cca0f2e0..6c07f455 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -84,6 +84,27 @@ services:
       - "traefik.enable=true"
       - "traefik.http.routers.front.rule=PathPrefix(`/`)"
 
+  auth:
+    build:
+      context: ./auth
+      dockerfile: Dockerfile.dev
+    restart: on-failure
+    depends_on:
+      postgres:
+        condition: service_healthy
+    ports:
+      - "4568:4568"
+    env_file:
+      - ./.env
+    volumes:
+      - ./auth:/app
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.auth.rule=PathPrefix(`/auth/`)"
+      - "traefik.http.routers.auth.middlewares=auth-sp"
+      - "traefik.http.middlewares.auth-sp.stripprefix.prefixes=/auth"
+      - "traefik.http.middlewares.auth-sp.stripprefix.forceSlash=false"
+
   scanner:
     build: ./scanner
     restart: on-failure