diff --git a/.dockerignore b/.dockerignore
index 49281d5..d4077f6 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -2,6 +2,7 @@ Dockerfile
 Makefile
 _site/
 site_export/
+.jekyll-cache
 .vscode/
 .git/
 .gitignore
diff --git a/Dockerfile b/Dockerfile
index ad8ff5c..5f9ec5e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,25 +1,29 @@
+# use Ruby as the foundation since Jekyll needs it
+# Alpine to keep the container a bit lighter
 FROM ruby:3-alpine AS builder
 LABEL stage=milksad-website-builder
-RUN apk update && apk add g++ make imagemagick imagemagick-dev imagemagick-libs
+
+# install necessary system dependencies for Jekyll and plugins
+RUN apk update && \
+    apk add g++ make imagemagick imagemagick-dev imagemagick-libs && \
+    rm -rf /var/cache/apk/*
+
 RUN mkdir -p /home
-COPY Gemfile /home
-COPY Gemfile.lock /home
-# copying _vendor is not needed at the moment
-# COPY _vendor /home/_vendor
-WORKDIR /home
+# also creates user directory
+RUN adduser -D builder
+USER builder
+RUN mkdir -p /home/builder/workdir
+WORKDIR /home/builder/workdir
+
+# copy the Jekyll website contents into the container
+# this includes Gemfile and Gemfile.lock
+# reminder: .dockerignore should specify a good ignorelist for this
+COPY --chown=builder . .
+
+# install Gems
 RUN bundle install
-COPY . /home
+
+# do the initial website build
 RUN jekyll build
 
-# FROM debian:bookworm AS mime-types
-# RUN apt-get update && apt-get install -y media-types
-# RUN echo 'types {' > /tmp/mime.types
-# RUN sed -e '/^$/d' -e 's/$/;/' /etc/mime.types >> /tmp/mime.types
-# RUN echo '}' >> /tmp/mime.types
-
-
-# FROM nginx:1.25
-# COPY nginx.conf /etc/nginx/nginx.conf
-# COPY --from=builder /home/_site /usr/share/nginx/html
-# COPY --from=mime-types /tmp/mime.types /etc/nginx/mime.types
-# COPY --from=builder /home/_site /usr/share/nginx/html
+# note: this Dockerfile is no longer responsible for serving the content to end users
diff --git a/Makefile b/Makefile
index 90730af..78c863a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,6 @@
 # flexible use with docker and podman
 platform ?= docker
+container_workdir = /home/builder/workdir/
 
 .PHONY: build
 build:
@@ -13,12 +14,12 @@ fullclean: clean
 
 .PHONY: clean
 clean:
-	rm -r site_export
+	rm -rf site_export
 
 site_export: build
 	rm -rf site_export
 	mkdir -p site_export
-	$(platform) run milksad-website tar c -C /home/_site . | tar x -C site_export
+	$(platform) run milksad-website tar c -C ${container_workdir}/_site . | tar x -C site_export
 
 #.PHONY: serve
 #serve: build
@@ -35,8 +36,8 @@ build-dev:
 
 .PHONY: dev
 dev: build-dev
-	$(platform) run --rm --expose 4000 -p 127.0.0.1:4000:4000 -v ${PWD}:/home -it dev-milksad-website jekyll serve -H 0.0.0.0
+	$(platform) run --rm --expose 4000 -p 127.0.0.1:4000:4000 --mount type=bind,source=${PWD},target=${container_workdir} -it dev-milksad-website jekyll serve -H 0.0.0.0
 
 .PHONY: dev-shell
 dev-shell: build-dev
-	$(platform) run --rm --expose 4000 -p 127.0.0.1:4000:4000 -v ${PWD}:/home -it dev-milksad-website sh
+	$(platform) run --rm --expose 4000 -p 127.0.0.1:4000:4000 --mount type=bind,source=${PWD},target=${container_workdir} -it dev-milksad-website sh