diff --git a/.env.dist b/.env.dist
index a7f645f..8e394c3 100644
--- a/.env.dist
+++ b/.env.dist
@@ -37,6 +37,11 @@ DOCKER_NETWORK=pleroma
 # Named docker volumes are currently not supported.
 DOCKER_DATADIR=./data
 
+# The uid/gid used by pleroma.
+# custom.d will be automatically chown'ed to this.
+DOCKER_UID=1000
+DOCKER_GID=1000
+
 ###########################
 #    Database settings    #
 ###########################
diff --git a/.gitignore b/.gitignore
index 800446a..aa4b1f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -71,3 +71,4 @@ $RECYCLE.BIN/
 
 
 # End of https://www.gitignore.io/api/osx,linux,windows
+debug.d
diff --git a/Dockerfile b/Dockerfile
index 2ad1bd5..beeba9c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,37 +1,69 @@
-FROM elixir:1.6-alpine
+FROM elixir:1.7-slim
 
-ENV MIX_HOME /mix
-ENV MIX_ARCHIVES /mix-archives
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LANG=C.UTF-8
+ENV MIX_ENV=prod
 
-# Prepare system
-RUN apk add --no-cache --virtual .build alpine-sdk git rsync
+VOLUME /custom.d
 
-# Bust the cache with a build arg
-# that is different on every build
+EXPOSE 4000
+
+# Register pseudo-entrypoint
+ADD ./entrypoint.sh /
+RUN chmod +x /entrypoint.sh
+CMD ["/entrypoint.sh"]
+
+# Set "real" entrypoint to an init system.
+# TODO: Replace with --init when docker 18.06 is GA
+ENV TINI_VERSION v0.18.0
+ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /tini
+RUN chmod +x /tini
+ENTRYPOINT ["/tini", "--"]
+
+# Get git
+RUN \
+       apt-get update \
+    && apt-get install -y --no-install-recommends git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Limit rights
+ARG DOCKER_UID
+ARG DOCKER_GID
+ARG PLEROMA_UPLOADS_PATH
+
+RUN \
+       addgroup --gid ${DOCKER_GID} pleroma \
+    && adduser --system --home /pleroma --shell /bin/bash --ingroup pleroma --uid ${DOCKER_UID} pleroma \
+    && mkdir -p /pleroma /custom.d $PLEROMA_UPLOADS_PATH \
+    && touch /pleroma.md5 \
+    && chown -R pleroma:pleroma /pleroma /pleroma.md5 /custom.d $PLEROMA_UPLOADS_PATH
+
+USER pleroma
+
+# Get the sources and rebar/hex
+ARG PLEROMA_VERSION
+WORKDIR /pleroma
+
+RUN \
+       git clone --progress https://git.pleroma.social/pleroma/pleroma.git . \
+    && mix local.hex --force \
+    && mix local.rebar --force
+
+# Bust the build cache
 ARG __BUST_CACHE
 ENV __BUST_CACHE $__BUST_CACHE
 
-# Get the sources
-ARG PLEROMA_VERSION
-WORKDIR /pleroma
-RUN git clone --progress https://git.pleroma.social/pleroma/pleroma.git . && git checkout $PLEROMA_VERSION
+# Fetch changes, checkout
+RUN \
+       git fetch --all \
+    && git checkout $PLEROMA_VERSION \
+    && git pull --rebase --autostash
 
-# Inject config
+# Modify sources
 ADD ./docker-config.exs /docker-config.exs
+
 RUN \
     ln -s /docker-config.exs config/prod.secret.exs && \
     ln -s /docker-config.exs config/dev.secret.exs
 
-# Correct paths
-WORKDIR /
-VOLUME /custom.d
-
-# Register entrypoint
-ADD ./entrypoint.ash /
-RUN chmod +x /entrypoint.ash
-CMD ["/entrypoint.ash"]
-
-# Call entrypoint to precompile pleroma
-RUN /entrypoint.ash onbuild
-
-EXPOSE 4000
+ADD ./custom.d /pleroma
diff --git a/README.md b/README.md
index af20141..9d03d26 100644
--- a/README.md
+++ b/README.md
@@ -68,7 +68,7 @@ If you need to fix some bigger issues you can also spawn a shell using `./plerom
 ## Customizing Pleroma
 
 Just add your customizations (and their folder structure) to `custom.d`.<br>
-They will be copied (*not* mounted) into the right place when the container starts.<br>
+They will be mounted and symlinked into the right place when the container starts.<br>
 You can even replace/patch pleroma's code with this, because the project is recompiled at startup.<br>
 
 In general: Prepending `custom.d/` to pleroma's customization guides should work all the time.<br>
@@ -76,6 +76,8 @@ Check them out in the [official pleroma wiki](https://git.pleroma.social/pleroma
 
 For example: A custom thumbnail now goes into `custom.d/priv/static/instance/thumbnail.jpeg` instead of `priv/static/instance/thumbnail.jpeg`.
 
+Note: Since `custom.d` needs to be accessible at runtime by the pleroma process, the container will automatically chown these files to `$UID:$GID` from your `.env` file.
+
 ## Configuring Pleroma
 
 pleroma-docker tries to stay out of your way as much as possible while providing
diff --git a/docker-compose.m4 b/docker-compose.m4
index 17548be..b06a1cd 100644
--- a/docker-compose.m4
+++ b/docker-compose.m4
@@ -85,7 +85,10 @@ define(<env_inline_fb>, <${upcase($1):-$2}>)
       "build": {
         "context": ".",
         "args": [
-          "env(<pleroma_version>)"
+          "env(<pleroma_version>)",
+          "env(<docker_uid>)",
+          "env(<docker_gid>)",
+          "env_fb(<pleroma_uploads_path>, </uploads>)",
         ]
       },
       "restart": "unless-stopped",
diff --git a/entrypoint.ash b/entrypoint.ash
deleted file mode 100755
index 2f4600c..0000000
--- a/entrypoint.ash
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/ash
-
-set -e
-
-function compile {
-    # Make sure that the tooling is present
-    if [[ ! -d /mix-archives/hex-* ]] || [[ ! -f /mix/rebar ]] || [[ ! -f /mix/rebar3 ]]; then
-        mix local.hex --force
-        mix local.rebar --force
-    fi
-
-    # Recompile
-    mix deps.get
-    mix compile
-}
-
-# Execute onbuild actions if required
-if [[ "$1" == "onbuild" ]]; then
-    # Pretend we're in runtime mode
-    mv /pleroma /pleroma-runtime
-    cd /pleroma-runtime
-
-    # Build pleroma
-    compile
-
-    # Put precompiled sources back
-    cd /
-    mv /pleroma-runtime /pleroma
-    exit 0
-fi
-
-# Ensure that the environment is clean
-if [[ -d /pleroma-runtime ]]; then
-    rm -rf /pleroma-runtime
-fi
-mkdir /pleroma-runtime
-
-# Copy sources
-rsync -azI /pleroma/ /pleroma-runtime/
-
-# Copy overrides
-rsync -azI /custom.d/ /pleroma-runtime/
-
-# Go to runtime workspace
-cd /pleroma-runtime
-
-# Build
-compile
-
-# Prepare DB
-mix ecto.create
-mix ecto.migrate
-
-# Liftoff o/
-exec mix phx.server
diff --git a/entrypoint.sh b/entrypoint.sh
new file mode 100755
index 0000000..35f5365
--- /dev/null
+++ b/entrypoint.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -e
+set -x
+
+mix deps.get
+mix ecto.create
+mix ecto.migrate
+exec mix phx.server
diff --git a/pleroma b/pleroma
index 783a839..6d36de4 100755
--- a/pleroma
+++ b/pleroma
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 set -e
+set -o pipefail
 
 print_help() {
     echo "
@@ -10,23 +11,36 @@ Usage:
     $0 [action]
 
 Actions:
-    build                     Rebuild the pleroma container
+    build                     Rebuild the pleroma container.
 
-    start / up                Start pleroma and sibling services
+    dump                      Dump the generated docker-compose.yml to stdout.
 
-    stop / down               Stop pleroma and sibling services
+    debug [bin] [args...]     Launches a new pleroma container but uses \$bin instead of phx.server as entrypoint.
+                              **Warning**: This is intended for debugging pleroma with tools like :debugger and :observer.
+                              It thus forwards your X-Server into docker and temporarily fiddles with your xhost
+                              access controls. If this is a security concern for you, please export NO_X_FORWARDING=1
+                              before launching a debugger session.
+
+    enter                     Spawn a shell inside the container for debugging/maintenance.
+                              This command does not link to the postgres container.
+                              If you need that use #debug instead.
+
+    logs                      Show the current container logs.
+
+    mix [task] [args...]      Run a mix task without entering the container.
+
+    mod [file]                Creates the file in custom.d and downloads the content from pleroma.social.
+                              The download respects your \$PLEROMA_VERSION from .env.
+
+    passthrough / p [...]     Pass any custom command to docker-compose.
 
     restart                   Executes #stop and #start respectively.
 
-    status / ps               Show the current container status
+    start / up                Start pleroma and sibling services.
 
-    logs                      Show the current container logs
+    stop / down               Stop pleroma and sibling services.
 
-    enter                     Enter the pleroma container for debugging/maintenance
-
-    mix [task] [args...]      Run a mix task without entering the container
-
-    dump                      Dump the generated docker-compose.yml to stdout
+    status / ps               Show the current container status.
 
 Environment:
     DEBUG can be used to modify the loglevel.
@@ -38,7 +52,7 @@ Environment:
         -e is always on unless you set it to +e.
 
         For setting long options with -o use a colon (:) instead of a space
-        to seperate the option from -o. For example: SHOPT='-x -e -o:pipefail'
+        to seperate the option from -o. For example: SHOPT='-x -e -o:pipefail'.
 
 Contributing:
     You can report bugs or contribute to this project at:
@@ -77,26 +91,55 @@ load_env() {
     done < .env
 }
 
-action__build()   { docker_compose build --build-arg __BUST_CACHE="$(date +%s)" server; }
-action__debug()   { render_template; }
-action__down()    { action__stop; }
-action__enter()   { docker_compose exec server ash -c 'cd /pleroma && ash'; }
-action__lint()    { render_template | jq; }
-action__logs()    { docker_compose logs -f; }
-action__mix()     { docker_compose exec server ash -c "cd /pleroma && mix $*"; }
-action__ps()      { action__status; }
-action__restart() { action__stop; action__start; }
-action__start()   { docker_compose up --remove-orphans -d; }
-action__status()  { docker_compose ps; }
-action__stop()    { docker_compose down; }
-action__up()      { action__start; }
+action__build()       { docker_compose build --build-arg __BUST_CACHE="$(date +%s)" server; }
+action__dump()        { cat <(render_template); }
+action__enter()       { docker_compose exec server ash -c 'cd /pleroma && ash'; }
+action__logs()        { docker_compose logs -f; }
+action__mix()         { docker_compose exec server ash -c "cd /pleroma && mix $*"; }
+action__passthrough() { docker_compose $*; }
+action__p()           { action__passthrough $*; }
 
-action__dump() {
-    if command -v jq 2>&1 1>/dev/null; then
-        cat <(render_template) | jq
-    else
-        cat <(render_template)
+action__restart()     { action__stop; action__start; }
+
+action__start()       { docker_compose up --remove-orphans -d; }
+action__up()          { action__start; }
+
+action__stop()        { docker_compose down; }
+action__down()        { action__stop; }
+
+action__status()      { docker_compose ps; }
+action__ps()          { action__status; }
+
+###
+# This function rips out the mix caches from the container
+# in order to speed up rebuilds during debugging/modding sessions.
+# To persist the changes, the user still needs to rebuild the container.
+###
+action__debug() {
+    debug_mounts="-v $(pwd)/custom.d:/custom.d -v $(pwd)/debug.d/build:/pleroma/_build -v $(pwd)/debug.d/deps:/pleroma/deps"
+
+    if [[ ! -d ./debug.d ]]; then
+        mkdir -p ./debug.d/{build,deps}
     fi
+
+    action__stop
+
+    docker_compose run --rm -u pleroma -w /pleroma $debug_mounts server bash -c 'mix deps.get && mix compile'
+
+    x_flags=""
+    if [[ $NO_X_FORWARDING != 1 ]]; then
+        x_flags="-e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix -v $HOME/.Xauthority:/pleroma/.Xauthority"
+    fi
+
+    [[ $NO_X_FORWARDING == 1 ]] || xhost +local:root
+    docker_compose run --rm -u pleroma -w /pleroma $debug_mounts $x_flags server bash -c "cp -rf /custom.d/* /pleroma && $*"
+    [[ $NO_X_FORWARDING == 1 ]] || xhost -local:root
+}
+
+action__mod() {
+    echo "Preparing 'custom.d/$1' for modding..."
+    install -D <(echo '') ./custom.d/$1
+    wget -O ./custom.d/$1 https://git.pleroma.social/pleroma/pleroma/raw/$PLEROMA_VERSION/$1
 }
 
 # Check if there is any command at all