- trim container image size - sanitize socktop inputs

files/README.md

@@ -2,6 +2,23 @@
 
 This directory contains configuration files that will be mounted into the Docker container at runtime.
 
+## Docker Usage
+
+When using Docker (via `docker-compose.yml` or `scripts/docker-quickstart.sh`):
+
+1. **Files are mounted directly** to the proper locations in the container:
+   - `alacritty.toml` → `/home/socktop/.config/alacritty/alacritty.toml`
+   - `catppuccin-frappe.toml` → `/home/socktop/.config/alacritty/catppuccin-frappe.toml`
+   - `profiles.json` → `/home/socktop/.config/socktop/profiles.json`
+   - `*.pem` certificates → `/home/socktop/.config/socktop/certs/`
+
+2. **Files are read-only** in the container (mounted with `:ro` flag)
+
+3. **To update configuration**: 
+   - Edit files in this directory on your host
+   - Changes are immediately visible in the container (no restart needed for most configs)
+   - For some changes, restart may be needed: `docker-compose restart` or `scripts/docker-quickstart.sh restart`
+
 ## Required Files
 
 Place your actual configuration files in this directory before building/running the container:
@@ -25,11 +42,27 @@ Place your actual configuration files in this directory before building/running
 - Copy from: `profiles.json.example`
 - Update with your actual host IPs and connection details
 
-### 3. SSH Keys
+### 3. SSH Certificates (Optional)
 
 **`rpi-master.pem`**
 - SSH private key for master node
-- **IMPORTANT**: Set permissions to 600
+- **Permissions**: Must be `600` (will be auto-fixed by entrypoint)
+- Only needed if connecting to remote systems
+
+**`rpi-worker-1.pem`, `rpi-worker-2.pem`, `rpi-worker-3.pem`**
+- SSH private keys for worker nodes
+- **Permissions**: Must be `600`
+- Optional - add as needed for your systems
+
+**Note**: If no certificates are provided, the container will still work for local monitoring.
+
+### 4. Docker-Specific Notes
+
+- Files are mounted directly from this directory to their final locations in the container
+- Files are mounted read-only (`:ro`) for security
+- Certificate permissions should be `600` on the host before mounting
+- For local testing, you can comment out the certificate mounts in docker-compose.yml
+- Without certificates, the container will still work for local monitoring
 
 **`rpi-worker-1.pem`**
 - SSH private key for worker node 1