diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..ad6e6b8
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,12 @@
+# -- PixivFE configuration
+# Visit https://codeberg.org/VnPower/PixivFE/wiki/Environment-variables for more details
+
+# -- Required
+# PIXIVFE_TOKEN=changethis # Only set here if not using a secret
+PIXIVFE_PORT=8282
+PIXIVFE_IMAGEPROXY=pixiv.ducks.party
+
+# -- Optional
+# PIXIVFE_USERAGENT=
+# PIXIVFE_BASEURL=
+# PIXIVFE_ACCEPTLANGUAGE=
diff --git a/.gitignore b/.gitignore
index 57098f8..82cbb72 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,7 @@
 /tmp
 dev.sh
 /pixivfe
-.sass-cache/
\ No newline at end of file
+.sass-cache/
+.env
+# exclude changes to pixivfe_token.txt
+docker/pixivfe_token.txt
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 76f5fc0..0813e3f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,37 @@
+# ------ Builder stage ------
 FROM docker.io/golang:1.21 as builder
 WORKDIR /app
+
 COPY go.* ./
 RUN go mod download
 COPY . ./
-RUN CGO_ENABLED=0 GOOS=linux go build -mod=readonly -v -o pixivfe
 
-FROM docker.io/alpine:3
-COPY --from=builder /app/pixivfe /pixivfe
-COPY --from=builder /app/views /views
+# Build the application binary with optimisations for a smaller, static binary
+RUN CGO_ENABLED=0 GOOS=linux go build -mod=readonly -v -ldflags="-s -w" -o pixivfe
+
+# ------ Final image ------
+FROM docker.io/alpine:3.14
+WORKDIR /app
+
+# Create a non-root user `pixivfe` for security purposes and set ownership
+RUN addgroup -g 1000 -S pixivfe && \
+    adduser -u 1000 -S pixivfe -G pixivfe && \
+    chown -R pixivfe:pixivfe /app
+
+# Copy the compiled application and other necessary files from the builder stage
+COPY --from=builder /app/pixivfe /app/pixivfe
+COPY --from=builder /app/views /app/views
+COPY ./docker/entrypoint.sh /entrypoint.sh
+# Include entrypoint script and ensure it's executable
+RUN chmod +x /entrypoint.sh && \
+    chown pixivfe:pixivfe /entrypoint.sh
+
+# Use the non-root user to run the application
+USER pixivfe
+
 EXPOSE 8282
 
-ENTRYPOINT ["/pixivfe"]
+ENTRYPOINT ["/entrypoint.sh"]
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=15s --start-interval=5s --retries=3 \
+ CMD wget --spider -q --tries=1 http://127.0.0.1:8282/about || exit 1
diff --git a/docker-compose.yml b/docker-compose.yml
index 30c5269..a5ad62b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,8 +4,8 @@ services:
   pixivfe:
     container_name: pixivfe
     hostname: pixivfe
-    restart: always
-    user: 65534:65534
+    restart: unless-stopped
+    user: 1000:1000
     read_only: true
     security_opt:
       - no-new-privileges:true
@@ -15,9 +15,19 @@ services:
       context: .
       dockerfile: Dockerfile
     ports:
-      - "8282:8282"
-    environment:
-      # Visit https://codeberg.org/VnPower/PixivFE/wiki/Environment-variables for more details
-      - PIXIVFE_TOKEN=changethis
-      - PIXIVFE_PORT=8282
-      - PIXIVFE_IMAGEPROXY=pximg.cocomi.cf
+      - "8282:8282" # Specify `127.0.0.1:8282:8282` instead if using a reverse proxy
+    env_file: .env
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://127.0.0.1:8282/about"]
+      interval: 30s
+      timeout: 3s
+      start_period: 15s
+      retries: 3
+    secrets:
+      - pixivfe_token
+
+secrets:
+  pixivfe_token:
+    # Copy the contents of the `PHPSESSID` cookie into `pixivfe_token.txt`
+    # See https://codeberg.org/VnPower/pixivfe/wiki/How-to-get-the-cookie-%28PIXIVFE_TOKEN%29 for instructions
+    file: ./docker/pixivfe_token.txt
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
new file mode 100755
index 0000000..1c826ed
--- /dev/null
+++ b/docker/entrypoint.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# Check if the secret file exists at /run/secrets/pixivfe_token
+if [ -f /run/secrets/pixivfe_token ]; then
+    export PIXIVFE_TOKEN=$(cat /run/secrets/pixivfe_token)
+    echo "Info: PIXIVFE_TOKEN loaded from secret."
+else
+    echo "Info: PIXIVFE_TOKEN not loaded from secret. Loading the environment variable normally."
+fi
+
+# Execute the main application
+exec /app/pixivfe "$@"
diff --git a/docker/pixivfe_token.txt b/docker/pixivfe_token.txt
new file mode 100644
index 0000000..237d7df
--- /dev/null
+++ b/docker/pixivfe_token.txt
@@ -0,0 +1 @@
+changethis