diff --git a/Controllers/HomeController.cs b/Controllers/HomeController.cs
index a44cafd..cbbe21b 100644
--- a/Controllers/HomeController.cs
+++ b/Controllers/HomeController.cs
@@ -55,7 +55,7 @@ namespace CarCareTracker.Controllers
         {
             try
             {
-                var configFileContents = System.IO.File.ReadAllText("userConfig.json");
+                var configFileContents = System.IO.File.ReadAllText("config/userConfig.json");
                 var existingUserConfig = System.Text.Json.JsonSerializer.Deserialize<UserConfig>(configFileContents);
                 if (existingUserConfig is not null)
                 {
@@ -69,7 +69,7 @@ namespace CarCareTracker.Controllers
                     userConfig.UserNameHash = string.Empty;
                     userConfig.UserPasswordHash = string.Empty;
                 }
-                System.IO.File.WriteAllText("userConfig.json", System.Text.Json.JsonSerializer.Serialize(userConfig));
+                System.IO.File.WriteAllText("config/userConfig.json", System.Text.Json.JsonSerializer.Serialize(userConfig));
                 return Json(true);
             } catch (Exception ex)
             {
diff --git a/Controllers/LoginController.cs b/Controllers/LoginController.cs
index 6a18601..e2432aa 100644
--- a/Controllers/LoginController.cs
+++ b/Controllers/LoginController.cs
@@ -36,7 +36,7 @@ namespace CarCareTracker.Controllers
             //compare it against hashed credentials
             try
             {
-                var configFileContents = System.IO.File.ReadAllText("userConfig.json");
+                var configFileContents = System.IO.File.ReadAllText("config/userConfig.json");
                 var existingUserConfig = System.Text.Json.JsonSerializer.Deserialize<UserConfig>(configFileContents);
                 if (existingUserConfig is not null)
                 {
@@ -74,7 +74,7 @@ namespace CarCareTracker.Controllers
         {
             try
             {
-                var configFileContents = System.IO.File.ReadAllText("userConfig.json");
+                var configFileContents = System.IO.File.ReadAllText("config/userConfig.json");
                 var existingUserConfig = JsonSerializer.Deserialize<UserConfig>(configFileContents);
                 if (existingUserConfig is not null)
                 {
@@ -86,7 +86,7 @@ namespace CarCareTracker.Controllers
                     existingUserConfig.UserNameHash = hashedUserName;
                     existingUserConfig.UserPasswordHash = hashedPassword;
                 }
-                System.IO.File.WriteAllText("userConfig.json", JsonSerializer.Serialize(existingUserConfig));
+                System.IO.File.WriteAllText("config/userConfig.json", JsonSerializer.Serialize(existingUserConfig));
                 return Json(true);
             }
             catch (Exception ex)
@@ -101,7 +101,7 @@ namespace CarCareTracker.Controllers
         {
             try
             {
-                var configFileContents = System.IO.File.ReadAllText("userConfig.json");
+                var configFileContents = System.IO.File.ReadAllText("config/userConfig.json");
                 var existingUserConfig = JsonSerializer.Deserialize<UserConfig>(configFileContents);
                 if (existingUserConfig is not null)
                 {
@@ -110,7 +110,7 @@ namespace CarCareTracker.Controllers
                     existingUserConfig.UserNameHash = string.Empty;
                     existingUserConfig.UserPasswordHash = string.Empty;
                 }
-                System.IO.File.WriteAllText("userConfig.json", JsonSerializer.Serialize(existingUserConfig));
+                System.IO.File.WriteAllText("config/userConfig.json", JsonSerializer.Serialize(existingUserConfig));
                 //destroy any login cookies.
                 Response.Cookies.Delete("ACCESS_TOKEN");
                 return Json(true);
diff --git a/Program.cs b/Program.cs
index d485dba..bd2f83b 100644
--- a/Program.cs
+++ b/Program.cs
@@ -23,7 +23,7 @@ if (!Directory.Exists("data"))
 }
 
 //Additional JsonFile
-builder.Configuration.AddJsonFile("userConfig.json", optional: true, reloadOnChange: true);
+builder.Configuration.AddJsonFile("config/userConfig.json", optional: true, reloadOnChange: true);
 
 //Configure Auth
 builder.Services.AddDataProtection();
diff --git a/README.md b/README.md
index c382a15..01844d1 100644
--- a/README.md
+++ b/README.md
@@ -18,4 +18,36 @@ Because nobody should have to deal with a homemade spreadsheet or a shoebox full
 - Bootstrap-DatePicker
 - SweetAlert2
 - CsvHelper
-- Chart.js
\ No newline at end of file
+- Chart.js
+
+## Docker
+
+### manual
+
+- build
+
+```
+docker build -t hargata/lubelog:latest .
+```
+
+- run
+
+```
+docker run -d hargata/lubelog:latest
+```
+
+add `-v` for persistent volumes as needed. Have a look at the docker-compose.yml for examples.
+
+## docker-compose
+
+- build image
+
+```
+docker compose build
+```
+
+- run
+
+```
+docker compose build
+```
diff --git a/userConfig.json b/config/userConfig.json
similarity index 100%
rename from userConfig.json
rename to config/userConfig.json
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..19010b8
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,47 @@
+---
+version: "3.4"
+
+services:
+  app:
+    image: hargata/lubelog:latest
+    build: .
+    restart: unless-stopped
+    # volumes used to keep data persistent
+    volumes:
+      - config:/App/config
+      - data:/App/data
+      - documents:/App/wwwroot/documents
+      - images:/App/wwwroot/images
+      - log:/App/log
+    # expose port and/or use serving via traefik
+    ports:
+      - 8080:8080
+    # traefik configurations, including networks can be commented out if not needed
+    networks:
+      - traefik-ingress
+    labels:
+      ## Traefik General
+      # We set 'enable by default' to false, so this tells Traefik we want it to connect here
+      traefik.enable: true
+      # define network for traefik<>app communication
+      traefik.docker.network: traefik-ingress
+      ## HTTP Routers
+      traefik.http.routers.whoami.entrypoints: https
+      traefik.http.routers.whoami.rule: Host(`lubelog.mydomain.tld`)
+      ## Middlewares
+      #traefik.http.routers.whoami.middlewares: authentik@docker
+      # none
+      ## HTTP Services
+      traefik.http.services.whoami.loadbalancer.server.port: 5000
+
+volumes:
+  config:
+  data:
+  documents:
+  images:
+  log:
+
+networks:
+  app:
+  traefik-ingress:
+    external: true