diff --git a/README.md b/README.md
index 37a5dac..6abb542 100644
--- a/README.md
+++ b/README.md
@@ -27,11 +27,59 @@ serve the directory with any static file server, for example:
 python3 -m http.server
 ```
 
+## Container
+
+The site is packaged as a container based on `nginxinc/nginx-unprivileged`. It
+runs as a non-root user and listens on port **8080**, serving the static files
+and exposing a `/healthz` endpoint. It is designed to sit behind an external
+reverse proxy that terminates TLS and routes by host.
+
+Build and run locally:
+
+```sh
+docker build -t dlr .
+docker run --rm -p 8080:8080 dlr
+# then browse http://localhost:8080
+```
+
+## CI
+
+`.gitea/workflows/build-and-publish.yml` builds the container with Gitea Actions
+and publishes it to this Gitea instance's container registry on pushes to `main`
+and on `v*` tags. Pull requests build the image but do not push. Authentication
+uses the automatically provided `GITEA_TOKEN`; the registry host is derived from
+the Gitea server URL.
+
+The published image is `<gitea-host>/<owner>/<repo>`, tagged by branch, semver
+(for `v*` tags), commit SHA, and `latest` on the default branch.
+
+## Dependency updates
+
+`renovate.json` configures Renovate to keep dependencies current:
+
+- the Dockerfile base image,
+- the actions used in the Gitea workflow,
+- versioned front-end dependencies referenced in HTML.
+
+There are currently no external front-end dependencies. When one is added via a
+CDN, Renovate will track it if it is either annotated with a comment, e.g.
+
+```html
+<!-- renovate: datasource=npm depName=bootstrap -->
+<link href="https://cdn.example.com/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
+```
+
+or referenced through a versioned jsDelivr / unpkg npm URL, which is detected
+automatically.
+
 ## Files
 
-| File          | Purpose                                          |
-| ------------- | ------------------------------------------------ |
-| `index.html`  | Page structure.                                  |
-| `styles.css`  | Both colour schemes, selected via `data-theme`.  |
-| `messages.js` | The list of messages (fill this in).             |
-| `script.js`   | Random message selection and the theme toggle.   |
+| File                                  | Purpose                                          |
+| ------------------------------------- | ------------------------------------------------ |
+| `index.html`                          | Page structure.                                  |
+| `styles.css`                          | Both colour schemes, selected via `data-theme`.  |
+| `messages.js`                         | The list of messages (fill this in).             |
+| `script.js`                           | Random message selection and the theme toggle.   |
+| `Dockerfile` / `default.conf`         | Container image and nginx static-serving config. |
+| `.gitea/workflows/`                   | Gitea Actions build-and-publish pipeline.        |
+| `renovate.json`                       | Renovate dependency-update configuration.         |