diff --git a/.docker/app/startup.sh b/.docker/app/startup.sh
index 6d867af52..589125805 100644
--- a/.docker/app/startup.sh
+++ b/.docker/app/startup.sh
@@ -24,28 +24,32 @@ export PGPASSWORD=$TTRSS_DB_PASS
 
 [ ! -e /var/www/html/index.php ] && cp ${SCRIPT_ROOT}/index.php /var/www/html
 
-if [ ! -d $DST_DIR ]; then
-	mkdir -p $DST_DIR
-	chown $OWNER_UID:$OWNER_GID $DST_DIR
+if [ -z $SKIP_RSYNC_ON_STARTUP ]; then
+	if [ ! -d $DST_DIR ]; then
+		mkdir -p $DST_DIR
+		chown $OWNER_UID:$OWNER_GID $DST_DIR
 
-	sudo -u app rsync -a \
-		$SRC_DIR/ $DST_DIR/
+		sudo -u app rsync -a \
+			$SRC_DIR/ $DST_DIR/
+	else
+		chown -R $OWNER_UID:$OWNER_GID $DST_DIR
+
+		sudo -u app rsync -a --delete \
+			--exclude /cache \
+			--exclude /lock \
+			--exclude /feed-icons \
+			--exclude /plugins/af_comics/filters.local \
+			--exclude /plugins.local \
+			--exclude /templates.local \
+			--exclude /themes.local \
+			$SRC_DIR/ $DST_DIR/
+
+		sudo -u app rsync -a --delete \
+			$SRC_DIR/plugins.local/nginx_xaccel \
+			$DST_DIR/plugins.local/nginx_xaccel
+	fi
 else
-	chown -R $OWNER_UID:$OWNER_GID $DST_DIR
-
-	sudo -u app rsync -a --delete \
-		--exclude /cache \
-		--exclude /lock \
-		--exclude /feed-icons \
-		--exclude /plugins/af_comics/filters.local \
-		--exclude /plugins.local \
-		--exclude /templates.local \
-		--exclude /themes.local \
-		$SRC_DIR/ $DST_DIR/
-
-	sudo -u app rsync -a --delete \
-		$SRC_DIR/plugins.local/nginx_xaccel \
-		$DST_DIR/plugins.local/nginx_xaccel
+	echo "warning: working copy in $DST_DIR won't be updated, make sure you know what you're doing."
 fi
 
 for d in cache lock feed-icons plugins.local themes.local; do
diff --git a/.dockerignore b/.dockerignore
index 2d2ecd68d..e8d95d4f1 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1 +1,5 @@
 .git/
+cache/
+plugins.local/
+templates.local/
+themes.local/
diff --git a/.env-dist b/.env-dist
new file mode 100644
index 000000000..c43ad0eed
--- /dev/null
+++ b/.env-dist
@@ -0,0 +1,47 @@
+# Copy this file to .env before building the container. Put any local modifications here.
+
+# Run FPM under this UID/GID.
+# OWNER_UID=1000
+# OWNER_GID=1000
+
+# FPM settings.
+#PHP_WORKER_MAX_CHILDREN=5
+#PHP_WORKER_MEMORY_LIMIT=256M
+
+# ADMIN_USER_* settings are applied on every startup.
+
+# Set admin user password to this value. If not set, random password will be generated on startup, look for it in the 'app' container logs.
+#ADMIN_USER_PASS=
+
+# Sets admin user access level to this value. Valid values:
+# -2 - forbidden to login
+# -1 - readonly
+#  0 - default user
+# 10 - admin
+#ADMIN_USER_ACCESS_LEVEL=
+
+# Auto create another user (in addition to built-in admin) unless it already exists.
+#AUTO_CREATE_USER=
+#AUTO_CREATE_USER_PASS=
+#AUTO_CREATE_USER_ACCESS_LEVEL=0
+
+# Default database credentials.
+TTRSS_DB_USER=postgres
+TTRSS_DB_NAME=postgres
+TTRSS_DB_PASS=password
+
+# You will likely need to set this to the correct value - it should point to external tt-rss URL as seen in your browser.
+TTRSS_SELF_URL_PATH=http://example.com/tt-rss
+
+# You can customize other config.php defines by setting overrides here. See tt-rss/.docker/app/Dockerfile for complete list. Examples:
+
+# TTRSS_PLUGINS=auth_remote
+# TTRSS_SINGLE_USER_MODE=true
+# TTRSS_SESSION_COOKIE_LIFETIME=2592000
+# TTRSS_FORCE_ARTICLE_PURGE=30
+# ...
+
+# Bind exposed port to 127.0.0.1 to run behind reverse proxy on the same host. If you plan expose the container, remove "127.0.0.1:".
+HTTP_PORT=127.0.0.1:8280
+#HTTP_PORT=8280
+
diff --git a/.gitignore b/.gitignore
index dc30e0bfd..9a0c6e9f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,6 @@
 Thumbs.db
+/.env
+/docker-compose.override.yml
 /.app_is_ready
 /messages.mo
 /node_modules
@@ -13,3 +15,4 @@ Thumbs.db
 /vendor/**/.git
 /.phpunit.result.cache
 /.phpstan-tmp
+/.tools/
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 000000000..5beb8dd07
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,56 @@
+# simplified compose for local building & development
+
+version: '3'
+
+services:
+  db:
+    image: postgres:15-alpine
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      - POSTGRES_USER=${TTRSS_DB_USER}
+      - POSTGRES_PASSWORD=${TTRSS_DB_PASS}
+      - POSTGRES_DB=${TTRSS_DB_NAME}
+
+  app:
+    image: cthulhoo/ttrss-fpm-pgsql-static:latest
+    build:
+      dockerfile: .docker/app/Dockerfile
+      context: .
+    restart: unless-stopped
+    env_file:
+      - .env
+    volumes:
+      - app:/var/www/html
+    depends_on:
+      - db
+
+  updater:
+    image: cthulhoo/ttrss-fpm-pgsql-static:latest
+    restart: unless-stopped
+    env_file:
+      - .env
+    volumes:
+      - app:/var/www/html
+    depends_on:
+      - app
+    command: /opt/tt-rss/updater.sh
+
+  web-nginx:
+    image: cthulhoo/ttrss-web-nginx:latest
+    build:
+      dockerfile: .docker/web-nginx/Dockerfile
+      context: .
+    restart: unless-stopped
+    env_file:
+      - .env
+    ports:
+      - ${HTTP_PORT}:80
+    volumes:
+      - app:/var/www/html:ro
+    depends_on:
+      - app
+
+volumes:
+  app: