diff --git a/.dockerignore b/.dockerignore
index dc00b9d..c8b5cce 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,4 +1,5 @@
 /vendor/
 /output/
 /.git/
+/satis.json
 
diff --git a/Dockerfile b/Dockerfile
index 8971720..a9a1395 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,15 @@
 FROM composer:latest
 
-# to experiment remote storage of public content
-RUN curl https://rclone.org/install.sh | bash
+ARG UID=1000
+ARG GID=1000
+RUN addgroup --gid "$GID" satis \
+ && adduser \
+    --disabled-password \
+    --gecos "" \
+    --home "/home/satis-gitlab" \
+    --ingroup "satis" \
+    --uid "$UID" \
+    satis
 
 RUN mkdir -p /opt/satis-gitlab
 WORKDIR /opt/satis-gitlab
@@ -9,5 +17,16 @@ COPY composer.json .
 COPY composer.lock .
 RUN composer install
 
-COPY . /opt/satis-gitlab
 WORKDIR /opt/satis-gitlab
+COPY src/ src
+COPY bin/ bin
+
+RUN mkdir -p /opt/satis-gitlab/config \
+ && chown -R satis:satis /opt/satis-gitlab/config
+VOLUME /opt/satis-gitlab/config
+
+RUN mkdir -p /opt/satis-gitlab/public \
+ && chown -R satis:satis /opt/satis-gitlab/public
+VOLUME /opt/satis-gitlab/public
+
+USER satis
diff --git a/README.md b/README.md
index 8999a7e..6bfb92f 100644
--- a/README.md
+++ b/README.md
@@ -123,7 +123,6 @@ Some command line options provide a basic customization options. You may also us
 
 [default-template.json](src/MBO/SatisGitlab/Resources/default-template.json)
 
-
 ## Testing
 
 ```bash
diff --git a/docs/docker.md b/docs/docker.md
index 909c4a7..e48761d 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -2,11 +2,10 @@
 
 ## Motivation
 
-Provide a docker image to use satis-gitlab to :
+Provide a docker image for satis-gitlab to :
 
 * Create a static site with pages using GitLab-CI or GitHub actions
 * Ease the built of a custom image with a custom update loop
-* Allow remote storage (like S3) of generated content using [rclone](https://rclone.org/)
 
 ## Build image
 
@@ -17,22 +16,29 @@ docker build -t satis-gitlab .
 ## Create static site content
 
 ```bash
-docker volume create satis-data
-docker run -v satis-data:/opt/satis-gitlab/public --env-file=../satis-gitlab.env --rm -ti satis-gitlab /bin/bash
-
+# create satis-gitlab container
+docker run \
+    -v satis-data:/opt/satis-gitlab/public \
+    -v satis-config:/opt/satis-gitlab/config \
+    --env-file=../satis-gitlab.env \
+    --rm -ti satis-gitlab /bin/bash
+
+# generate config/satis.json
 bin/satis-gitlab gitlab-to-config \
     --homepage https://satis.dev.localhost \
-    --output satis.json https://github.com \
-    --users=mborne $GITHUB_TOKEN
+    --output config/satis.json https://github.com \
+    --users=mborne $SATIS_GITHUB_TOKEN
 
-git config --global github.accesstoken $GITHUB_TOKEN
-bin/satis-gitlab build satis.json public
+# generate public from config/satis.json with satis
+git config --global github.accesstoken $SATIS_GITHUB_TOKEN
+bin/satis-gitlab build config/satis.json public -v
 ```
 
 ## Serve static site content
 
 ```bash
-docker run --rm -ti -v satis-data:/usr/share/nginx/html -p 8888:8080 nginxinc/nginx-unprivileged:1.25
+# see http://localhost:8888
+docker run --rm -ti -v satis-data:/usr/share/nginx/html -p 8888:8080 nginxinc/nginx-unprivileged:1.26
 ```