diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..0873015
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,11 @@
+.git
+.env
+config.json
+data/
+*.db
+test/
+dashboard/node_modules/
+extension/
+docs/
+*.zip
+node_modules/
diff --git a/Dockerfile b/Dockerfile
index 4ce1d8a..f86add4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,6 +12,11 @@ RUN mkdir -p /data
 ENV CLAWMARK_PORT=3458
 ENV CLAWMARK_DATA_DIR=/data
 
+RUN addgroup -S clawmark && adduser -S clawmark -G clawmark
+RUN chown -R clawmark:clawmark /app /data
+
 EXPOSE 3458
 
+USER clawmark
+
 CMD ["node", "server/index.js"]