diff --git a/.env.example b/.env.example
index 8f6149a..c7563cb 100644
--- a/.env.example
+++ b/.env.example
@@ -2,6 +2,7 @@ AUTH_SECRET=change-me-to-a-long-random-string
 # Optional: path to SQLite file (default ./data/rfid.db)
 # RFID_DB_PATH=./data/rfid.db
 
+<<<<<<< HEAD
 # Docker Compose published port (default 3000)
 # RFID_PORT=3000
 
@@ -10,6 +11,8 @@ AUTH_SECRET=change-me-to-a-long-random-string
 # CREATE_USER_PASSWORD=changeme
 # CREATE_USER_NAME=Admin
 
+=======
+>>>>>>> origin/main
 # Optional OIDC (Authentik, Keycloak, Authelia, etc.)
 # AUTH_OIDC_ISSUER=https://sso.example.com/application/o/rfid/
 # AUTH_OIDC_CLIENT_ID=
diff --git a/Dockerfile b/Dockerfile
index b10b00c..f134ce6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,21 +2,33 @@
 
 FROM node:22-bookworm-slim AS deps
 WORKDIR /app
+<<<<<<< HEAD
 RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ \
   && rm -rf /var/lib/apt/lists/*
+=======
+RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
+>>>>>>> origin/main
 COPY package.json package-lock.json ./
 RUN npm ci
 
 FROM node:22-bookworm-slim AS builder
 WORKDIR /app
+<<<<<<< HEAD
 RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ \
   && rm -rf /var/lib/apt/lists/*
+=======
+RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
+>>>>>>> origin/main
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV AUTH_SECRET=build-time-placeholder-secret-32chars
+<<<<<<< HEAD
 RUN npm run build \
   && npm prune --omit=dev
+=======
+RUN npm run build
+>>>>>>> origin/main
 
 FROM node:22-bookworm-slim AS runner
 WORKDIR /app
@@ -24,6 +36,7 @@ ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
 ENV RFID_DB_PATH=/data/rfid.db
 ENV PORT=3000
+<<<<<<< HEAD
 ENV HOSTNAME=0.0.0.0
 ENV AUTH_TRUST_HOST=true
 
@@ -52,4 +65,18 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
   CMD curl -fsS http://127.0.0.1:3000/login >/dev/null || exit 1
 
 ENTRYPOINT ["/entrypoint.sh"]
+=======
+RUN apt-get update && apt-get install -y libstdc++6 && rm -rf /var/lib/apt/lists/*
+RUN mkdir -p /data && chown node:node /data
+COPY --from=builder /app/package.json /app/package-lock.json ./
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/.next ./.next
+COPY --from=builder /app/public ./public
+COPY --from=builder /app/scripts ./scripts
+COPY --from=builder /app/src ./src
+COPY --from=builder /app/tsconfig.json ./tsconfig.json
+USER node
+EXPOSE 3000
+VOLUME ["/data"]
+>>>>>>> origin/main
 CMD ["npm", "run", "start"]
diff --git a/README.md b/README.md
index 8f7b55c..5cb4656 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,7 @@ GitHub Actions runs lint, typecheck, and tests on every pull request and push to
 
 ## Docker
 
+<<<<<<< HEAD
 ### docker compose (recommended)
 
 ```bash
@@ -116,16 +117,26 @@ docker compose down
 
 ### Plain docker
 
+=======
+>>>>>>> origin/main
 ```bash
 docker build -t rfid-database .
 docker run --rm -p 3000:3000 \
   -e AUTH_SECRET=your-long-secret \
+<<<<<<< HEAD
   -e CREATE_USER_EMAIL=admin@lab.local \
   -e CREATE_USER_PASSWORD=changeme \
+=======
+>>>>>>> origin/main
   -v rfid-data:/data \
   rfid-database
 ```
 
+<<<<<<< HEAD
+=======
+Create the first user against the mounted DB (exec into the container or run `create-user` with `RFID_DB_PATH` pointed at the volume).
+
+>>>>>>> origin/main
 ## Security
 
 Tag dumps often include sector keys. Keep the app behind HTTPS, do not expose it publicly without auth, and treat `data/rfid.db` as sensitive.