diff --git a/CLAUDE.md b/CLAUDE.md
index 6f566bd..5300e99 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -189,6 +189,7 @@ Environment variables can override sensitive values:
 - `PORT` - OAuth server port
 - `CLIENT_SECRET_ANILIST` - AniList client secret
 - `CLIENT_SECRET_MYANIMELIST` - MyAnimeList client secret
+- `TOKEN_FILE_PATH` - Token file path for persistent authentication
 
 ## Key Dependencies
 
diff --git a/Dockerfile b/Dockerfile
index eeba841..e707670 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,11 +15,13 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod=vendor -ldflags="-w -s"
 FROM alpine:3.19
 
 RUN apk --no-cache add ca-certificates tzdata && \
-    mkdir -p /etc/anilist-mal-sync
+    mkdir -p /etc/anilist-mal-sync && \
+    adduser -D -u 10001 appuser && \
+    mkdir -p /home/appuser/.config/anilist-mal-sync && \
+    chown -R appuser:appuser /home/appuser
 
 WORKDIR /app
 COPY --from=builder /build/main ./main
-COPY --from=builder /etc/passwd /etc/passwd
 
 USER appuser
 
diff --git a/README.md b/README.md
index 9704e77..1be1654 100644
--- a/README.md
+++ b/README.md
@@ -134,6 +134,7 @@ Override sensitive values:
 - `PORT` - OAuth server port (default: 18080)
 - `CLIENT_SECRET_ANILIST` - AniList client secret
 - `CLIENT_SECRET_MYANIMELIST` - MyAnimeList client secret
+- `TOKEN_FILE_PATH` - Token file path (default: `~/.config/anilist-mal-sync/token.json`)
 
 ## Advanced
 
diff --git a/config.go b/config.go
index 0bc5522..a133b5d 100644
--- a/config.go
+++ b/config.go
@@ -72,6 +72,10 @@ func loadConfigFromFile(filename string) (Config, error) {
 		cfg.MyAnimeList.ClientSecret = clientSecret
 	}
 
+	if tokenFilePath := os.Getenv("TOKEN_FILE_PATH"); tokenFilePath != "" {
+		cfg.TokenFilePath = tokenFilePath
+	}
+
 	if cfg.TokenFilePath == "" {
 		cfg.TokenFilePath = os.ExpandEnv("$HOME/.config/anilist-mal-sync/token.json")
 	}
diff --git a/docker-compose.example.yaml b/docker-compose.example.yaml
new file mode 100644
index 0000000..c2abe71
--- /dev/null
+++ b/docker-compose.example.yaml
@@ -0,0 +1,9 @@
+version: "3"
+services:
+  sync:
+    image: ghcr.io/bigspawn/anilist-mal-sync:latest
+    command: ["watch"]
+    volumes:
+      - ./config.yaml:/etc/anilist-mal-sync/config.yaml:ro
+      - ./tokens:/home/appuser/.config/anilist-mal-sync
+    restart: unless-stopped