diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..45ec64b
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,8 @@
+.git
+.gitignore
+media/
+__pycache__/
+*.pyc
+.DS_Store
+README.md
+AGENTS.md
diff --git a/Dockerfile b/Dockerfile
index 1bb8819..c1e7356 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,12 +1,16 @@
-FROM python:3.12-slim
+FROM python:3.13-slim
 
 WORKDIR /app
 
-COPY requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt gunicorn
 
 COPY . .
 
+RUN addgroup --system app && adduser --system --ingroup app app && \
+    chown -R app:app /app
+USER app
+
 EXPOSE 5005
 
-CMD ["python", "app.py"]
+CMD ["gunicorn", "-b", "0.0.0.0:5005", "-w", "4", "app:app"]
diff --git a/README.md b/README.md
index 50ded9f..566dbea 100755
--- a/README.md
+++ b/README.md
@@ -124,6 +124,8 @@ Server läuft auf `http://localhost:5005`.
 docker compose up -d
 ```
 
+Server läuft auf `http://localhost:5005` (gunicorn mit 4 Workern, non-root User).
+
 ---
 
 ## Routen
diff --git a/app.py b/app.py
index 52f2172..6da3f68 100755
--- a/app.py
+++ b/app.py
@@ -1584,6 +1584,7 @@ def admin_users_reset_password(email):
 # -------------------------------------------------
 # Main
 # -------------------------------------------------
+init_user_db()
+
 if __name__ == "__main__":
-    init_user_db()
     app.run(debug=True, host="0.0.0.0", port=5005)