diff --git a/Dockerfile b/Dockerfile
index 542343ae..f0942ede 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -47,3 +47,27 @@ ENTRYPOINT ["/opt/cosmic-clash/cosmic-clash-server"]
 FROM exporter AS smoke-client
 WORKDIR /workspace
 ENTRYPOINT ["godot", "--headless", "--path", "Game", "res://tests/export_server_smoke.tscn", "--"]
+
+# Builds the process supervisor (server/supervisor, multiplayer-next.md task
+# 8.27/8.28) that wraps the Agones-allocated dedicated server as PID 1.
+# golang:1.23-alpine (matches server/go.mod's `go 1.23`), resolved 2026-09-01.
+FROM --platform=linux/amd64 golang@sha256:383395b794dffa5b53012a212365d40c8e37109a626ca30d6151c8348d380b5f AS supervisor-build
+WORKDIR /workspace/server
+COPY server/go.mod server/go.sum ./
+RUN go mod download
+COPY server/ ./
+RUN CGO_ENABLED=0 go build -o /opt/cosmic-clash/game-server-supervisor ./cmd/game-server-supervisor
+
+# Agones-allocated fleet image: the same dedicated-server export as `server`
+# (unchanged above; make verify-phase6 exercises that target exactly as
+# before), wrapped by the Go supervisor as PID 1 instead of the direct
+# launcher script -- required for process-ready/assignment-ready Agones SDK
+# calls and control-plane registration (multiplayer-next.md §8.27/§8.28).
+# deploy/k8s/base/fleet.yaml does not reference this target yet: the
+# per-deployment supervisor flags (--sdk-base-url, --control-plane-url,
+# --workload-token-path, ...) still need to be decided and added to the
+# Fleet pod template, along with the projected workload-token volume.
+FROM server AS game-server
+COPY --from=supervisor-build /opt/cosmic-clash/game-server-supervisor /opt/cosmic-clash/game-server-supervisor
+RUN chmod 0755 /opt/cosmic-clash/game-server-supervisor
+ENTRYPOINT ["/opt/cosmic-clash/game-server-supervisor"]