diff --git a/Dockerfile b/Dockerfile
index 7c2b83c..3f22476 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,11 +5,7 @@ WORKDIR /build
 COPY . .
 
 RUN set -ex \
-	&& apk update \
-	&& apk upgrade \
 	&& apk add --no-cache build-base \
-	&& apk add --no-cache ca-certificates \
-	&& update-ca-certificates \
 	&& go mod download \
 	&& go mod verify \
 	&& make build \
@@ -17,6 +13,8 @@ RUN set -ex \
 
 FROM alpine
 
+ARG USER_ID=1000
+
 ENV PUSHBITS_HTTP_PORT="8080"
 
 EXPOSE 8080
@@ -27,11 +25,13 @@ COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /build/app ./run
 
 RUN set -ex \
+	&& apk add --no-cache ca-certificates curl \
+	&& update-ca-certificates \
 	&& mkdir -p /data \
 	&& ln -s /data/pushbits.db /app/pushbits.db \
 	&& ln -s /data/config.yml /app/config.yml
 
-USER 1000
+USER ${USER_ID}
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=5s CMD curl --fail http://localhost:$PUSHBITS_HTTP_PORT/health || exit 1
 
diff --git a/README.md b/README.md
index 1a4c603..4c9385f 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,6 @@
 [![Build status](https://img.shields.io/github/workflow/status/pushbits/server/Main)](https://github.com/pushbits/server/actions)
-[![Docker Pulls](https://img.shields.io/docker/pulls/eikendev/pushbits)](https://hub.docker.com/r/eikendev/pushbits)
+[![Docker Hub pulls](https://img.shields.io/docker/pulls/eikendev/pushbits)](https://hub.docker.com/r/eikendev/pushbits)
+[![Image size](https://img.shields.io/docker/image-size/eikendev/pushbits)](https://hub.docker.com/r/eikendev/pushbits)
 ![License](https://img.shields.io/github/license/pushbits/server)
 
 # PushBits