diff --git a/Dockerfile b/Dockerfile
index 1f510dd..95e0386 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,38 +1,24 @@
 # syntax=docker/dockerfile:1.7
 
 # ============================================================================
-# Build stage: Debian 12's Python (paths/libs match the distroless runtime)
+# Build stage: install Python dependencies into a dedicated prefix
 # ============================================================================
-# We deliberately do NOT use python:3.11-slim-bookworm here — that image is
-# Python.org's, which installs Python to /usr/local with an RPATH pointing
-# back into /usr/local/lib. Distroless has libpython under /usr/lib, so the
-# RPATH would break. Debian's apt-installed python3 lives at the same paths
-# as distroless's, so symlinks and libpython all resolve correctly.
-FROM debian:12-slim AS builder
+FROM python:3.11-slim-bookworm AS builder
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     PIP_NO_CACHE_DIR=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1
 
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
-         python3 python3-pip python3-venv \
-    && rm -rf /var/lib/apt/lists/*
-
-# Default (symlink) venv. /opt/venv/bin/python ends up as a symlink to
-# /usr/bin/python3, which distroless also provides.
-RUN python3 -m venv /opt/venv
-ENV PATH=/opt/venv/bin:$PATH
-
-# Install runtime deps into the venv's site-packages
-RUN pip install \
+# Install runtime deps into /install. --target keeps everything in one tree
+# so we can copy it cleanly to a distroless image without venv/shebang issues.
+RUN pip install --target=/install \
       fastapi==0.115.* \
       "uvicorn[standard]==0.30.*" \
       redis==5.0.*
 
-# Pre-compile bytecode for faster cold start on a read-only rootfs
-RUN python3 -m compileall -q /opt/venv
+# Pre-compile bytecode for faster cold start under a read-only rootfs
+RUN python -m compileall -q /install
 
 # ============================================================================
 # Runtime stage: distroless Python 3.11, non-root, no shell
@@ -43,19 +29,21 @@ RUN python3 -m compileall -q /opt/venv
 FROM gcr.io/distroless/python3-debian12:nonroot
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1
+    PYTHONUNBUFFERED=1 \
+    PYTHONPATH=/app/lib
 
 WORKDIR /app
 
-# Venv ships its site-packages; its bin/python symlink resolves against
-# distroless's /usr/bin/python3 and Debian's libpython at /usr/lib/...
-COPY --from=builder --chown=nonroot:nonroot /opt/venv /opt/venv
+# Site-packages first (rarely changes → maximises layer cache)
+COPY --from=builder --chown=nonroot:nonroot /install /app/lib
 
-# Application source (its own layer so source-only changes don't bust dep cache)
+# Application source (changes most often → its own layer)
 COPY --chown=nonroot:nonroot app.py favicon.ico /app/
 
 USER nonroot
 EXPOSE 8000
 
-ENTRYPOINT ["/opt/venv/bin/python", "-m", "uvicorn"]
+# Module form (-m uvicorn) sidesteps broken shebangs in /app/lib/bin/uvicorn
+# (those were generated against the builder's Python path, not distroless's).
+ENTRYPOINT ["/usr/bin/python3", "-m", "uvicorn"]
 CMD ["app:app", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/README.md b/README.md
index c7ae1ff..2deca5a 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Aukpad
 
-Simple **temporary live collaboration notepad** with websockets and FastAPI — pads expire automatically after a configurable retention period.
+Simple **live collaboration notepad** with websockets and FastAPI.
 
 [Issue tracker](https://git.uphillsecurity.com/cf7/aukpad/issues) | `Libera Chat #aukpad` 
 
@@ -16,34 +16,23 @@ The goal is to keep it simple! For feature-rich solutions please check out [hedg
 ## Features
 
 **Use cases:**
-- shared notepad across multiple machines
+- shared notepad on multiple machines
 - collaboration on the same notepage with multiple people (notes, config, etc)
-- piping configs: `curl -o app.conf https://aukpad.com/{pad_id}/raw` → edit in aukpad → repeat
+- config changes in aukpad > `curl -o app.conf https://aukpad.com/{pad_id}/raw` > change config in aukpad > repeat `curl` command
 
-**Editor:**
-- real-time WebSocket collaboration with cursor preservation across remote edits
-- per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI
-- line numbers; Tab inserts 4 spaces
-- dark / light mode (auto-detects system preference, manual toggle)
-- copy-to-clipboard and "new pad" buttons, live peer count in the header
+**Available**:
+- live collab notepad
+- line numbers
+- custom path `{pad_id}` for more privacy (1–64 chars, `[a-zA-Z0-9_-]`)
+- optional caching with valkey/redis
+- pad creation with HTTP post requests with curl (see *Usage*)
+- `{pad_id}/raw` HTTP endpoint 
+- optional password protection (HTTP endpoint accessible with GET /{pad_id}/raw?pw=mysecurepasswordhunter2)
 
-**Endpoints:**
-- custom pad path `{pad_id}` (1–64 chars, `[a-zA-Z0-9_-]`); auto-generated IDs are 8-char `[a-z0-9]`
-- `POST /` — create a pad from request body (curl-friendly, see *Usage*)
-- `GET /{pad_id}/raw` — raw text (auth via `?pw=…` for protected pads)
-- `GET /system/info` — instance configuration page
-- WebSocket `/ws/{pad_id}` — live collaboration
-
-**Deployment:**
-- optional Valkey/Redis cache for cross-restart persistence
-- configurable text-size, connection, room, and retention limits
-- per-IP rate limiting (pad creation + failed password attempts), reverse-proxy aware
-- distroless, non-root, read-only-rootfs container image
-
-**Ideas:**
+**Ideas**:
 [Check out the open feature requests](https://git.uphillsecurity.com/cf7/aukpad/issues?q=&type=all&sort=&state=open&labels=12&milestone=0&project=0&assignee=0&poster=0&archived=false)
 
-**Not planned:**
+**Not planned**:
 - accounts / RBAC
 
 ---
@@ -72,6 +61,10 @@ ip -br a | curl -X POST https://aukpad.com --data-binary @-   # command output
 
 Open `127.0.0.1:8000`
 
+Alternative, use Github Container Repository:
+
+`ghcr.io/caffeinefueled1/aukpad:latest`
+
 **Adv. example with Podman**
 
 ```bash
@@ -100,6 +93,7 @@ podman run -d --name aukpad-app \
     --tmpfs /tmp \
     --security-opt no-new-privileges:true \
     --cap-drop ALL \
+    --user 1000:1000 \
     -e USE_VALKEY=true \
     -e VALKEY_URL=redis://:xeZNopyIeMMncqDFPHtJQwMwIathgMWo@localhost:6379 \
     -e MAX_TEXT_SIZE=5 \
@@ -136,6 +130,12 @@ For security concerns or reports, please contact via `hello a t uphillsecurity d
 
 ---
 
+## Notes
+
+- [Github Mirror available](https://github.com/CaffeineFueled1/aukpad)
+
+---
+
 ## License
 
 **Apache License**
diff --git a/app.py b/app.py
index 7d5b619..46d29ee 100644
--- a/app.py
+++ b/app.py
@@ -68,8 +68,8 @@ def init_valkey():
             redis_client = redis.from_url(VALKEY_URL, decode_responses=True)
             redis_client.ping()  # Test connection
             print(f"Valkey/Redis connected: {VALKEY_URL}")
-        except ImportError as e:
-            print(f"Warning: redis package import failed ({e}), falling back to memory-only storage")
+        except ImportError:
+            print("Warning: redis package not installed, falling back to memory-only storage")
             redis_client = None
         except Exception as e:
             print(f"Warning: Failed to connect to Valkey/Redis: {e}")
@@ -590,18 +590,6 @@ def get_system_info():
   <div class="info-section">
     <h2>Instance</h2>
     <p>{DESCRIPTION}</p>
-    <p>Simple <strong>temporary live collaboration notepad</strong> with websockets and FastAPI — pads expire automatically after a configurable retention period.</p>
-  </div>
-
-  <div class="info-section">
-    <h2>Features</h2>
-    <ul>
-      <li>real-time WebSocket collaboration with cursor preservation across remote edits</li>
-      <li>per-pad password protection (PBKDF2-SHA256), with a built-in password generator in the UI</li>
-      <li>line numbers; Tab inserts 4 spaces</li>
-      <li>dark / light mode (auto-detects system preference, manual toggle)</li>
-      <li>copy-to-clipboard and "new pad" buttons, live peer count in the header</li>
-    </ul>
   </div>
 
   <div class="info-section">