diff --git a/docker/Dockerfile b/docker/Dockerfile
index 5879b03..b5ed96c 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -17,19 +17,31 @@ WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 
-# Public env vars must be present at build time (baked into client bundle)
+# All vars needed during "npm run build":
+# - NEXT_PUBLIC_* are baked into the client bundle
+# - Server vars are needed because Next.js runs server code during page-data collection
 ARG NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY
 ARG NEXT_PUBLIC_SUPABASE_URL
+ARG CLERK_SECRET_KEY
+ARG SUPABASE_SERVICE_ROLE_KEY
+ARG UPSTASH_REDIS_REST_URL
+ARG UPSTASH_REDIS_REST_TOKEN
+ARG DATABASE_URL
+
 ENV NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=$NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY
 ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL
-
+ENV CLERK_SECRET_KEY=$CLERK_SECRET_KEY
+ENV SUPABASE_SERVICE_ROLE_KEY=$SUPABASE_SERVICE_ROLE_KEY
+ENV UPSTASH_REDIS_REST_URL=$UPSTASH_REDIS_REST_URL
+ENV UPSTASH_REDIS_REST_TOKEN=$UPSTASH_REDIS_REST_TOKEN
+ENV DATABASE_URL=$DATABASE_URL
 ENV NEXT_TELEMETRY_DISABLED=1
 
 RUN npx prisma generate
 RUN npm run build
 
 # ──────────────────────────────────────────────
-# Stage 3: production image
+# Stage 3: production image (minimal)
 # ──────────────────────────────────────────────
 FROM node:22-alpine AS runner
 WORKDIR /app
@@ -40,7 +52,6 @@ ENV NEXT_TELEMETRY_DISABLED=1
 RUN addgroup --system --gid 1001 nodejs \
  && adduser  --system --uid 1001 nextjs
 
-# Copy the standalone output (includes node_modules tree-shaken to minimum)
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 84c06d2..39fd276 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -4,16 +4,20 @@ services:
       context: ..
       dockerfile: docker/Dockerfile
       args:
-        # These two are baked into the client bundle at build time.
-        # All other vars are injected at runtime via env_file below.
+        # All vars needed at build time (Next.js runs server code during build)
         NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}
         NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
+        CLERK_SECRET_KEY: ${CLERK_SECRET_KEY}
+        SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
+        UPSTASH_REDIS_REST_URL: ${UPSTASH_REDIS_REST_URL}
+        UPSTASH_REDIS_REST_TOKEN: ${UPSTASH_REDIS_REST_TOKEN}
+        DATABASE_URL: ${DATABASE_URL}
     image: pawfeed:latest
     container_name: pawfeed
     restart: unless-stopped
     ports:
-      - "3000:3000"
+      - "4563:3000"
     env_file:
-      - ../.env.local   # copy .env.example → .env.local and fill in your values
+      - ../.env.local
     environment:
       NODE_ENV: production
diff --git a/docker/start.sh b/docker/start.sh
new file mode 100644
index 0000000..b8a541d
--- /dev/null
+++ b/docker/start.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+# Start PawFeed — run this script from anywhere.
+# It automatically passes .env.local to docker compose for both
+# build-args and container runtime.
+set -e
+cd "$(dirname "$0")"
+docker compose --env-file ../.env.local up -d --build
+echo "PawFeed is starting on http://localhost:4563"