diff --git a/Dockerfile b/Dockerfile
index a245e5c..1c8b620 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,14 +23,40 @@ RUN cargo fetch --target x86_64-unknown-linux-musl
 # magic feature excluded (requires shared libmagic; fallback uses `file` command)
 COPY src/ src/
 RUN cargo build --release --target x86_64-unknown-linux-musl \
-    --no-default-features --features lz4,gzip \
+    --no-default-features --features lz4,gzip,server,mcp,swagger,client,tls \
     && strip target/x86_64-unknown-linux-musl/release/keep
 
 # Runtime stage - scratch since binary is fully static
 FROM scratch
 
 COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/keep /keep
+COPY --from=builder /etc/ssl/certs/ /etc/ssl/certs/
 
 EXPOSE 21080
 
+# General options
+# ENV KEEP_CONFIG=/config/config.yml
+# Mount a volume for persistent storage: -v keep-data:/data
+ENV KEEP_DIR=/data
+ENV KEEP_LIST_FORMAT="id,time,size,tags,meta:hostname"
+
+# Item options
+# ENV KEEP_COMPRESSION=lz4
+# ENV KEEP_META_PLUGINS=""
+# ENV KEEP_FILTERS=""
+
+# Server options
+ENV KEEP_SERVER_ADDRESS=0.0.0.0
+ENV KEEP_SERVER_PORT=21080
+# ENV KEEP_SERVER_PASSWORD=""
+# ENV KEEP_SERVER_PASSWORD_HASH=""
+
+# TLS options
+# ENV KEEP_SERVER_CERT=/certs/cert.pem
+# ENV KEEP_SERVER_KEY=/certs/key.pem
+
+# Client options
+# ENV KEEP_CLIENT_URL=""
+# ENV KEEP_CLIENT_PASSWORD=""
+
 ENTRYPOINT ["/keep"]
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..7d71e3b
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,27 @@
+services:
+  keep:
+    build: .
+    ports:
+      - "21080:21080"
+    volumes:
+      - keep-data:/data
+      - keep-config:/config
+    environment:
+      - KEEP_SERVER_ADDRESS=0.0.0.0
+      - KEEP_SERVER_PORT=21080
+      # - KEEP_SERVER_PASSWORD=changeme
+      # - KEEP_SERVER_PASSWORD_HASH=
+      # - KEEP_COMPRESSION=lz4
+      # - KEEP_META_PLUGINS=
+      # - KEEP_FILTERS=
+      - KEEP_CONFIG=/config/config.yml
+      # - KEEP_SERVER_CERT=/certs/cert.pem
+      # - KEEP_SERVER_KEY=/certs/key.pem
+    restart: unless-stopped
+    # For TLS, mount certificate files:
+    # volumes:
+    #   - ./certs:/certs:ro
+
+volumes:
+  keep-data:
+  keep-config: