diff --git a/.dockerignore b/.dockerignore
index 93f1361..4e727ef 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,2 +1,9 @@
+docs/
+scripts/
+.gitignore
+.dockerignore
+docker-compose.yml
+Dockerfile
 node_modules
 npm-debug.log
+README.md
diff --git a/Dockerfile b/Dockerfile
index e941d42..5ef4982 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,18 +1,32 @@
-FROM node:lts
+FROM node:15
 
-WORKDIR /usr/src/app
+ARG TINI_VER="v0.19.0"
 
-COPY package*.json ./
+# install tini
+ADD https://github.com/krallin/tini/releases/download/$TINI_VER/tini /sbin/tini
+RUN chmod +x /sbin/tini
 
-RUN echo Installing dependencies \
-	&& apt-get update \
-	&& apt-get install sqlite3 -y \
-	&& npm ci 
+# install sqlite3
+RUN apt-get update                                                   \
+ && apt-get install    --quiet --yes --no-install-recommends sqlite3 \
+ && apt-get clean      --quiet --yes                                 \
+ && apt-get autoremove --quiet --yes                                 \
+ && rm -rf /var/lib/apt/lists/*
 
+# copy minetrack files
+WORKDIR /usr/src/minetrack
 COPY . .
-	
-RUN npm run build
+
+# build minetrack
+RUN npm install --build-from-source \
+ && npm run build
+
+# run as non root
+RUN addgroup --gid 10043 --system minetrack \
+ && adduser  --uid 10042 --system --ingroup minetrack --no-create-home --gecos "" minetrack \
+ && chown -R minetrack:minetrack /usr/src/minetrack
+USER minetrack
 
 EXPOSE 8080
 
-CMD node main.js
+ENTRYPOINT ["/sbin/tini", "--", "node", "main.js"]
diff --git a/README.md b/README.md
index 9c130d1..d3576d3 100644
--- a/README.md
+++ b/README.md
@@ -43,3 +43,41 @@ For updates and release notes, please read the [CHANGELOG](docs/CHANGELOG.md).
 
 Database logging is disabled by default. You can enable it in ```config.json``` by setting ```logToDatabase``` to true.
 This requires sqlite3 drivers to be installed.
+
+## Docker
+Minetrack can be built and run with Docker from this repository in several ways:
+
+### Build and deploy directly with Docker:
+```
+# build image with name minetrack and tag latest
+docker build . --tag minetrack:latest
+# start container, delete on exit
+# publish container port 8080 on host port 80
+docker run --rm --publish 80:8080 minetrack:latest
+```
+The published port can be changed by modifying the parameter argument, e.g.:  
+Publish to host port 8080: `--publish 8080:8080`  
+Publish to localhost (thus prohibiting external access): `--publish 127.0.0.1:8080:8080`
+
+### Build and deploy with docker-compose:
+```
+# build and start service
+docker-compose up --build
+# stop service and remove artifacts
+docker-compose down
+```
+
+## Nginx reverse proxy
+The following configuration enables Nginx to act as reverse proxy for a Minetrack instance that is available at port 8080 on localhost:
+```
+server {
+    server_name minetrack.example.net;
+    listen 80;
+    location / {
+        proxy_pass http://localhost:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+    }
+}
+```
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..12f489f
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,12 @@
+version: '3'
+
+services:
+  minetrack:
+    build: .
+    container_name: minetrack
+    dns:
+      - 8.8.8.8
+      - 1.1.1.1
+    ports:
+      - "80:8080"
+    restart: always