diff --git a/Dockerfile b/Dockerfile
index 01c40ff..872fce0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,42 +54,14 @@ WORKDIR /app
 
 COPY --from=backend-build /app/target/release/backend /app/backend
 COPY --from=frontend-build /app/frontend/dist /app/dist
+COPY --chmod=0755 entrypoint.sh /app/entrypoint.sh
 
-# Single entrypoint: substitute the real config into the prebuilt bundle, then
-# run both processes and exit (so the orchestrator restarts us) if either dies.
-RUN cat > /app/entrypoint.sh <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
+RUN mkdir -p /app/data && chown -R node:node /app/dist /app/data
 
-# Map the provided runtime variables onto the frontend's VITE_* placeholders.
-VITE_API_URL="${SERVER_URL:-}"
-VITE_RELAY_DOMAIN="${RELAY_DOMAIN:-}"
-VITE_PLATFORM_NAME="${PLATFORM_NAME:-}"
+USER node:node
 
-# Escape characters that are special in a sed replacement.
-esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
-
-echo "Applying runtime configuration to the frontend bundle..."
-while IFS= read -r -d '' f; do
-  sed -i \
-    -e "s|__VITE_API_URL__|$(esc "$VITE_API_URL")|g" \
-    -e "s|__VITE_RELAY_DOMAIN__|$(esc "$VITE_RELAY_DOMAIN")|g" \
-    -e "s|__VITE_PLATFORM_NAME__|$(esc "$VITE_PLATFORM_NAME")|g" \
-    "$f"
-done < <(find /app/dist -type f \( -name '*.js' -o -name '*.html' \) -print0)
-
-echo "Starting backend (:2892) and frontend (:3000)..."
-/app/backend &
-backend_pid=$!
-serve -s /app/dist -l 3000 &
-serve_pid=$!
-
-trap 'kill -TERM "$backend_pid" "$serve_pid" 2>/dev/null || true' TERM INT
-
-# Exit as soon as either process exits.
-wait -n
-EOF
-RUN chmod +x /app/entrypoint.sh
+ENV SERVER_PORT=2892 \
+    DATABASE_URL=sqlite:///app/data/caravel.db
 
 EXPOSE 2892 3000
 
diff --git a/README.md b/README.md
index 0f8dd86..59fcd57 100644
--- a/README.md
+++ b/README.md
@@ -20,9 +20,7 @@ docker run -d \
   -e RELAY_DOMAIN=example.com \
   -e APP_URL=https://example.com \
   -e ZOOID_API_URL=http://zooid:3334 \
-  -e DATABASE_URL=sqlite://data/caravel.db \
   -e SERVER_URL=https://api.example.com \
-  -e SERVER_PORT=2892 \
   -e SERVER_ADMIN_PUBKEYS=<your-hex-pubkey> \
   -e SERVER_ALLOW_ORIGINS=https://example.com \
   -e ROBOT_SECRET=<hex-nostr-secret-key> \
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 6c864b0..0656b46 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -61,7 +61,7 @@ async fn main() -> Result<()> {
         billing.start().await;
     });
 
-    let url = format!("127.0.0.1:{}", env::get().server_port);
+    let url = format!("0.0.0.0:{}", env::get().server_port);
     let listener = tokio::net::TcpListener::bind(url).await?;
 
     axum::serve(listener, app).await?;
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100755
index 0000000..44f3b49
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Substitute the real config into the prebuilt frontend bundle, then run the
+# backend and static server, exiting (so the orchestrator restarts us) if either
+# process dies.
+set -euo pipefail
+
+# Map the provided runtime variables onto the frontend's VITE_* placeholders.
+VITE_API_URL="${SERVER_URL:-}"
+VITE_RELAY_DOMAIN="${RELAY_DOMAIN:-}"
+VITE_PLATFORM_NAME="${PLATFORM_NAME:-}"
+
+# Escape characters that are special in a sed replacement.
+esc() { printf '%s' "$1" | sed -e 's/[&|\\]/\\&/g'; }
+
+echo "Applying runtime configuration to the frontend bundle..."
+while IFS= read -r -d '' f; do
+  sed -i \
+    -e "s|__VITE_API_URL__|$(esc "$VITE_API_URL")|g" \
+    -e "s|__VITE_RELAY_DOMAIN__|$(esc "$VITE_RELAY_DOMAIN")|g" \
+    -e "s|__VITE_PLATFORM_NAME__|$(esc "$VITE_PLATFORM_NAME")|g" \
+    "$f"
+done < <(find /app/dist -type f \( -name '*.js' -o -name '*.html' \) -print0)
+
+echo "Starting backend (:2892) and frontend (:3000)..."
+/app/backend &
+backend_pid=$!
+serve -s /app/dist -l 3000 &
+serve_pid=$!
+
+trap 'kill -TERM "$backend_pid" "$serve_pid" 2>/dev/null || true' TERM INT
+
+# Exit as soon as either process exits.
+wait -n