diff --git a/Dockerfile b/Dockerfile
index 84dbb57..b47c5c8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -8,7 +8,8 @@ COPY cmd ./cmd
 COPY internal ./internal
 RUN CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /pawsql ./cmd/pawsql
 
-FROM gcr.io/distroless/static-debian12:nonroot
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates docker-cli
 COPY --from=build /pawsql /usr/local/bin/pawsql
 ENTRYPOINT ["/usr/local/bin/pawsql"]
 CMD ["--config", "/etc/pawsql/Barkfile"]
diff --git a/README.md b/README.md
index 69f3588..6803a0f 100644
--- a/README.md
+++ b/README.md
@@ -33,10 +33,11 @@ docker build -t pawsql .
 docker run --rm --publish 5432:5432 \
   --volume "$PWD/Barkfile:/etc/pawsql/Barkfile:ro" \
   --volume "$PWD/tls:/etc/pawsql/tls:ro" \
+  --volume /var/run/docker.sock:/var/run/docker.sock \
   pawsql
 ```
 
-The provided image contains only PawSQL and is suitable for external `upstream` routes. Managed PostgreSQL routes require native PawSQL or a custom image that supplies a Docker CLI and access to the Docker Engine, typically through the Docker socket.
+The supplied image includes the Docker CLI so managed `postgres` routes can create, start, and stop their containers through the mounted Docker socket. The socket grants PawSQL root-equivalent control of the Docker host; mount it only for trusted Barkfiles and trusted administrators.
 
 ## Barkfile