diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index e545bef..81ac7d9 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -7,4 +7,4 @@ jobs:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
             - run: docker build .
-            - run: docker build backend/
+            - run: docker build -f Dockerfile.backend .
diff --git a/backend/Dockerfile b/Dockerfile.backend
similarity index 77%
rename from backend/Dockerfile
rename to Dockerfile.backend
index 49c87aa..d97bbbd 100644
--- a/backend/Dockerfile
+++ b/Dockerfile.backend
@@ -6,10 +6,11 @@ RUN apk add --no-cache git make gcc musl-dev
 # golangci-lint v2.7.2 (2026-02-27)
 RUN CGO_ENABLED=0 go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@9f61b0f53f80672872fced07b6874397c3ed197b
 
-WORKDIR /src
-COPY go.mod go.sum ./
+WORKDIR /repo/backend
+COPY backend/go.mod backend/go.sum ./
 RUN go mod download
-COPY . .
+COPY .git /repo/.git
+COPY backend/ .
 
 RUN make check
 RUN make build
@@ -18,8 +19,7 @@ RUN make build
 FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 
 RUN apk add --no-cache ca-certificates
-COPY --from=builder /src/netwatch-server /usr/local/bin/netwatch-server
-COPY --from=builder /src /src
+COPY --from=builder /repo/backend/netwatch-server /usr/local/bin/netwatch-server
 
 EXPOSE 8080
 ENTRYPOINT ["netwatch-server"]
diff --git a/backend/.dockerignore b/backend/.dockerignore
index 5414d56..fd4f2b0 100644
--- a/backend/.dockerignore
+++ b/backend/.dockerignore
@@ -1,3 +1,2 @@
-.git
 node_modules
 .DS_Store
diff --git a/backend/.gitignore b/backend/.gitignore
index 861bd94..e48380c 100644
--- a/backend/.gitignore
+++ b/backend/.gitignore
@@ -1,4 +1,4 @@
-netwatch-server
+/netwatch-server
 *.log
 *.out
 *.test
diff --git a/backend/Makefile b/backend/Makefile
index ad86aa0..38cebcf 100644
--- a/backend/Makefile
+++ b/backend/Makefile
@@ -37,7 +37,7 @@ fmt-check:
 check: test lint fmt-check
 
 docker:
-	timeout 300 docker build -t netwatch-server .
+	timeout 300 docker build -t netwatch-server -f ../Dockerfile.backend ..
 
 hooks:
 	@printf '#!/bin/sh\ncd backend && make check\n' > \
diff --git a/backend/cmd/netwatch-server/main.go b/backend/cmd/netwatch-server/main.go
new file mode 100644
index 0000000..3f3d86b
--- /dev/null
+++ b/backend/cmd/netwatch-server/main.go
@@ -0,0 +1,42 @@
+// Package main is the entry point for netwatch-server.
+package main
+
+import (
+	"sneak.berlin/go/netwatch/internal/config"
+	"sneak.berlin/go/netwatch/internal/globals"
+	"sneak.berlin/go/netwatch/internal/handlers"
+	"sneak.berlin/go/netwatch/internal/healthcheck"
+	"sneak.berlin/go/netwatch/internal/logger"
+	"sneak.berlin/go/netwatch/internal/middleware"
+	"sneak.berlin/go/netwatch/internal/reportbuf"
+	"sneak.berlin/go/netwatch/internal/server"
+
+	"go.uber.org/fx"
+)
+
+//nolint:gochecknoglobals // set via ldflags at build time
+var (
+	Appname   = "netwatch-server"
+	Version   string
+	Buildarch string
+)
+
+func main() {
+	globals.Appname = Appname
+	globals.Version = Version
+	globals.Buildarch = Buildarch
+
+	fx.New(
+		fx.Provide(
+			config.New,
+			globals.New,
+			handlers.New,
+			healthcheck.New,
+			logger.New,
+			middleware.New,
+			reportbuf.New,
+			server.New,
+		),
+		fx.Invoke(func(*server.Server) {}),
+	).Run()
+}