diff --git a/configs/nym/Containerfile b/configs/nym/Containerfile
new file mode 100644
index 0000000..ac6f003
--- /dev/null
+++ b/configs/nym/Containerfile
@@ -0,0 +1,39 @@
+# koopa-nym — nym-node (nym.com mixnet / NymVPN network)
+# Docs: https://nym.com/docs/operators/nodes/nym-node
+FROM docker.io/library/debian:bookworm-slim
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    NYM_HOME=/var/lib/nym \
+    PATH=/usr/local/bin:$PATH
+
+# Pin via build-arg when a new binary is released:
+#   https://github.com/nymtech/nym/releases
+ARG NYM_NODE_VERSION=1.35.0
+ARG NYM_NODE_URL=""
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      ca-certificates curl ca-certificates-java \
+      libssl3 \
+ && rm -rf /var/lib/apt/lists/* \
+ && mkdir -p /var/lib/nym /usr/local/bin
+
+# Prefer explicit URL; else GitHub release asset pattern for linux x86_64.
+RUN set -eux; \
+  if [ -n "$NYM_NODE_URL" ]; then \
+    curl -fsSL -o /usr/local/bin/nym-node "$NYM_NODE_URL"; \
+  else \
+    curl -fsSL -o /usr/local/bin/nym-node \
+      "https://github.com/nymtech/nym/releases/download/nym-binaries-v${NYM_NODE_VERSION}/nym-node"; \
+  fi; \
+  chmod +x /usr/local/bin/nym-node; \
+  /usr/local/bin/nym-node --version || true
+
+COPY entrypoint.sh /usr/local/bin/nym-entrypoint
+RUN chmod +x /usr/local/bin/nym-entrypoint
+
+# Defaults inside container (host maps different ports — see compose.yml)
+EXPOSE 1789/udp 1789/tcp 1790 8080 9000 51822/udp
+
+WORKDIR /var/lib/nym
+ENTRYPOINT ["/usr/local/bin/nym-entrypoint"]