diff --git a/.dockerignore b/.dockerignore
index fee5276..b849c8a 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,7 +1,6 @@
-.git
-docs/_build
-node_modules
-test_data
-light
-config.json
-*.mbtiles
+*
+!src
+!public
+!package.json
+!package-lock.json
+!docker-entrypoint.sh
diff --git a/Dockerfile b/Dockerfile
index 4bc76b7..6e03a0e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,30 +1,55 @@
-FROM node:10-stretch
+FROM node:10-buster AS builder
+
+RUN export DEBIAN_FRONTEND=noninteractive \
+  && apt-get -qq update \
+  && apt-get -y --no-install-recommends install \
+      apt-transport-https \
+      curl \
+      unzip \
+      build-essential \
+      python \
+      libcairo2-dev \
+      libgles2-mesa-dev \
+      libgbm-dev \
+      libllvm7 \
+      libprotobuf-dev \
+  && apt-get -y --purge autoremove \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY . /usr/src/app
+
+ENV NODE_ENV="production"
+
+RUN cd /usr/src/app && npm install --production
+
+
+FROM node:10-buster-slim AS final
+
+RUN export DEBIAN_FRONTEND=noninteractive \
+  && apt-get -qq update \
+  && apt-get -y --no-install-recommends install \
+      libgles2-mesa \
+      libegl1 \
+      xvfb \
+      xauth \
+  && apt-get -y --purge autoremove \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /usr/src/app /app
 
 ENV NODE_ENV="production"
 ENV CHOKIDAR_USEPOLLING=1
 ENV CHOKIDAR_INTERVAL=500
+
 VOLUME /data
 WORKDIR /data
-EXPOSE 80
-ENTRYPOINT ["/bin/bash", "/usr/src/app/run.sh"]
 
-RUN apt-get -qq update \
-&& DEBIAN_FRONTEND=noninteractive apt-get -y install \
-    apt-transport-https \
-    curl \
-    unzip \
-    build-essential \
-    python \
-    libcairo2-dev \
-    libgles2-mesa-dev \
-    libgbm-dev \
-    libllvm3.9 \
-    libprotobuf-dev \
-    libxxf86vm-dev \
-    xvfb \
-    x11-utils \
-&& apt-get clean
+EXPOSE 8000
 
-RUN mkdir -p /usr/src/app
-COPY / /usr/src/app
-RUN cd /usr/src/app && npm install --production
+USER node:node
+
+ENTRYPOINT ["/app/docker-entrypoint.sh"]
+
+CMD ["-p", "8000"]
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
new file mode 100755
index 0000000..8b7984c
--- /dev/null
+++ b/docker-entrypoint.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+set -e
+
+handle() {
+	SIGNAL=$(( $? - 128 ))
+	echo "Caught signal ${SIGNAL}, stopping gracefully"
+	kill -s ${SIGNAL} $(pidof node) 2>/dev/null
+}
+
+trap handle INT TERM
+
+if ! which -- "${1}"; then
+  # first arg is not an executable
+  xvfb-run -a --server-args="-screen 0 1024x768x24" -- node /app/ "$@" &
+	# Wait exits immediately on signals which have traps set. Store return value and wait
+	# again for all jobs to actually complete before continuing.
+	wait $! || RETVAL=$?
+	wait
+	exit ${RETVAL}
+fi
+
+exec "$@"