diff --git a/Dockerfile b/Dockerfile
index 808c8a7..3c0d457 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,20 +1,29 @@
 # ---------- build ----------
 FROM golang:1.24 AS builder
 WORKDIR /src
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-    build-essential ca-certificates && rm -rf /var/lib/apt/lists/*
+RUN apk add --no-cache build-base  # gcc/make/musl-dev pour cgo
+
 COPY go.mod go.sum ./
 RUN go mod download
+
 COPY . .
+# Si ton main est à la racine : "."
+# Sinon remplace le dernier "." par le chemin du package main.
 RUN CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -o /out/shelfy .
 
 # ---------- runtime ----------
-FROM debian:bookworm-slim
-RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-    ca-certificates tzdata busybox && rm -rf /var/lib/apt/lists/*
+FROM alpine:3.20
+# utilitaires utiles (shell, certificats, timezone)
+RUN apk add --no-cache ca-certificates tzdata
+
 WORKDIR /app
 COPY --from=builder /out/shelfy /app/shelfy
-COPY --from=builder /src/web /app/web   # <-- AJOUT
+RUN mkdir -p /app/web
+COPY web /app/web
+
+# Prépare les répertoires (DB, upload, logs)
 RUN mkdir -p /app/data /app/upload /var/log/shelfy \
- && chmod -R 0775 /app /var/log/shelfy
+ && chmod -R 0775 /var/log/shelfy /app
+
+# Lance l'appli et duplique les logs vers un fichier pour Fail2ban
 ENTRYPOINT ["/bin/sh","-lc","/app/shelfy 2>&1 | tee -a /var/log/shelfy/shelfy.log"]
diff --git a/docker-compose.yml b/docker-compose.yml
index 810e2bc..cc7fab1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,7 +19,9 @@ services:
     volumes:
       - shelfy_upload:/app/upload
       - shelfy_data:/app/data        # <-- volume pour SQLite
-      - shelfy_logs:/var/log/shelfy  # <-- logs lus par Fail2ban
+      - shelfy_logs:/var/log/shelfy 
+      - ./web:/app/web:ro          # <--- MONTE TON FRONT (lecture seule)
+ # <-- logs lus par Fail2ban
     labels:
       - traefik.http.routers.shelfy.middlewares=webdav-allow-methods@docker
       - traefik.http.middlewares.webdav-allow-methods.headers.accesscontrolallowmethods=GET,PUT,POST,DELETE,PROPFIND,OPTIONS,LOCK,UNLOCK,HEAD