diff --git a/Dockerfile b/Dockerfile
index d3802651..bc039519 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,13 +17,18 @@ RUN \
     cd app && go build -o /build/tg-spam -ldflags "-X main.revision=${version} -s -w"
 
 
-FROM umputun/baseimage:app-latest
+FROM ghcr.io/umputun/baseimage/app:v1.11.0 as base
+
+FROM scratch
+
 COPY --from=build /build/tg-spam /srv/tg-spam
-RUN chown -R app:app /srv
+COPY --from=base /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=base /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=base /etc/passwd /etc/passwd
+COPY --from=base /etc/group /etc/group
 
+USER app
 COPY data/* /data/
-
 VOLUME /data
 WORKDIR /srv
-
-CMD ["/srv/tg-spam"]
+ENTRYPOINT ["/srv/tg-spam"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 8d5d85af..bf517023 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,24 +1,20 @@
-version: '2'
 services:
-  telegram-bot:
-    build: .
+  tg-spam:
+    image: umputun/tg-spam:master # use :latest tag for production
     hostname: tg-spam
     restart: always
     container_name: tg-spam
-
     logging:
       driver: json-file
       options:
         max-size: "10m"
         max-file: "5"
-
     environment:
       - TELEGRAM_TOKEN
       - TELEGRAM_GROUP
       - DRY=true
       - DEBUG=true
     volumes:
-      - ./logs:/srv/logs
-      - ./html:/srv/html
+      - ./var:/data # map user-provided samples to /data
 
-    command: /srv/tg-spam --super=umputun --super=bobuk --super=grayru --super=ksenks
+    command: /srv/tg-spam --super=name1 --super=name2