diff --git a/.dockerignore b/.dockerignore
index 5d4b8fcc0..10cb02760 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,6 +1,7 @@
 storage
 data
 Dockerfile
+docker-compose.yml
 .dockerignore
 .git
 .gitignore
diff --git a/Dockerfile b/Dockerfile
index c076c6672..ec457f905 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,17 +1,33 @@
-FROM php:7.2-fpm-alpine
+FROM php:7.2.6-fpm-alpine
 
-RUN apk add --no-cache git imagemagick \
-    && apk add --no-cache --virtual .build build-base autoconf imagemagick-dev libtool \
-    && docker-php-ext-install pdo_mysql pcntl \
-    && pecl install imagick \
-    && docker-php-ext-enable imagick \
-    && apk del --purge .build
+ARG COMPOSER_VERSION="1.6.5"
+ARG COMPOSER_CHECKSUM="67bebe9df9866a795078bb2cf21798d8b0214f2e0b2fd81f2e907a8ef0be3434"
 
-RUN curl -sS https://getcomposer.org/installer | php \
-    && mv composer.phar /usr/local/bin/ \
-    && ln -s /usr/local/bin/composer.phar /usr/local/bin/composer
+RUN apk add --no-cache --virtual .build build-base autoconf imagemagick-dev libtool && \
+  apk --no-cache add imagemagick git && \
+  docker-php-ext-install pdo_mysql pcntl && \
+  pecl install imagick && \
+  docker-php-ext-enable imagick pcntl imagick && \
+  curl -LsS https://getcomposer.org/download/${COMPOSER_VERSION}/composer.phar -o /tmp/composer.phar && \
+  echo "${COMPOSER_CHECKSUM}  /tmp/composer.phar" | sha256sum -c - && \
+  install -m0755 -o root -g root /tmp/composer.phar /usr/bin/composer.phar && \
+  ln -sf /usr/bin/composer.phar /usr/bin/composer && \
+  mkdir -p /var/www && \
+  install -d -m0755 -o www-data -g www-data /var/www/html/pixelfed && \
+  install -d -m0755 -o www-data -g www-data /var/www/html/pixelfed/storage && \
+  install -d -m0755 -o www-data -g www-data /var/www/html/pixelfed/storage/framework && \
+  install -d -m0755 -o www-data -g www-data /var/www/html/pixelfed/storage/framework/sessions && \
+  install -d -m0755 -o www-data -g www-data /var/www/html/pixelfed/storage/framework/views && \
+  install -d -m0755 -o www-data -g www-data /var/www/html/pixelfed/storage/framework/cache && \
+  rm /tmp/composer.phar && \
+  apk del --purge .build
 
-WORKDIR /var/www/html
-COPY . .
+COPY --chown=www-data . /var/www/html/pixelfed/
+
+WORKDIR /var/www/html/pixelfed
+USER www-data
 RUN composer install --prefer-source --no-interaction
+
+VOLUME ["/var/www/html"]
+USER root
 ENV PATH="~/.composer/vendor/bin:./vendor/bin:${PATH}"
diff --git a/contrib/nginx.conf b/contrib/nginx.conf
index c39103d5a..39cfbdf4d 100644
--- a/contrib/nginx.conf
+++ b/contrib/nginx.conf
@@ -4,7 +4,7 @@ server {
 	server_name localhost;
 
 	index index.php index.html;
-	root /var/www/html/public;
+	root /var/www/html/pixelfed/public;
 
 	location / {
 		try_files $uri $uri/ /index.php;
diff --git a/docker-compose.yml b/docker-compose.yml
index d9c39bd2f..b49b77a77 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,37 +3,58 @@ version: '3'
 services:
   nginx:
     image: nginx:alpine
+    networks:
+      - internal
+      - external
     ports:
     - 3000:80
     volumes:
-    - .:/var/www/html
+    - "php-storage:/var/www/html"
     - ./contrib/nginx.conf:/etc/nginx/conf.d/default.conf
     depends_on:
-    - php
+      - php
+
   php:
     build: .
+    image: pixelfed
     volumes:
-    - ./storage:/var/www/html/storage
-    depends_on:
-    - mysql
-    - redis
+    - "php-storage:/var/www/html"
+    networks:
+      - internal
     environment:
       - DB_HOST=mysql
       - DB_DATABASE=pixelfed
-      - DB_USERNAME=${DB_USERNAME}
-      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_USERNAME=${DB_USERNAME:-pixelfed}
+      - DB_PASSWORD=${DB_PASSWORD:-pixelfed}
       - REDIS_HOST=redis
-      - APP_KEY=${APP_KEY}
+      - APP_KEY=${APP_KEY:-app_key}
+
   mysql:
     image: mysql:5.7
+    networks:
+      - internal
     environment:
       - MYSQL_DATABASE=pixelfed
-      - MYSQL_USER=${DB_USERNAME}
-      - MYSQL_PASSWORD=${DB_PASSWORD}
+      - MYSQL_USER=${DB_USERNAME:-pixelfed}
+      - MYSQL_PASSWORD=${DB_PASSWORD:-pixelfed}
+      - MYSQL_RANDOM_ROOT_PASSWORD="true"
     volumes:
-    - ./docker-volumes/mysql:/var/lib/mysql
+    - "mysql-data:/var/lib/mysql"
+
   redis:
     image: redis:alpine
     volumes:
-    - ./docker-volumes/redis:/data
-...
+    - "redis-data:/data"
+    networks:
+      - internal
+
+volumes:
+  redis-data:
+  mysql-data:
+  php-storage:
+
+networks:
+  internal:
+    internal: true
+  external:
+    driver: bridge