diff --git a/scripts/docker/Dockerfile.ac b/scripts/docker/Dockerfile.ac
index 47e8fcca..96306140 100644
--- a/scripts/docker/Dockerfile.ac
+++ b/scripts/docker/Dockerfile.ac
@@ -19,4 +19,4 @@ RUN     ash innvikler.sh ac
 
 WORKDIR /state
 EXPOSE  3923
-ENTRYPOINT ["python3", "-m", "copyparty", "-c", "/z/initcfg"]
+ENTRYPOINT ["/bin/ash", "/z/cpp.sh", "-c", "/z/initcfg"]
diff --git a/scripts/docker/Dockerfile.dj b/scripts/docker/Dockerfile.dj
index 4177e815..1d0eae5e 100644
--- a/scripts/docker/Dockerfile.dj
+++ b/scripts/docker/Dockerfile.dj
@@ -20,13 +20,13 @@ RUN     apk add -U !pyc \
             vips-jxl vips-heif vips-poppler vips-magick \
             py3-numpy fftw libsndfile \
             vamp-sdk vamp-sdk-libs keyfinder-cli \
-            libraw py3-numpy cython \
+            libraw py3-numpy \
         && apk add -t .bd \
             bash wget gcc g++ make cmake patchelf \
             python3-dev ffmpeg-dev fftw-dev libsndfile-dev \
             py3-wheel py3-numpy-dev libffi-dev \
             vamp-sdk-dev \
-            libraw-dev py3-numpy-dev \
+            libraw-dev py3-numpy-dev cython \
         && rm -f /usr/lib/python3*/EXTERNALLY-MANAGED \
         && python3 -m pip install pyvips \
         && python3 -m pip install "$(wget -O- https://api.github.com/repos/letmaik/rawpy/releases/latest | awk -F\" '$2=="tarball_url"{print$4}')" \
@@ -41,4 +41,4 @@ RUN     ash innvikler.sh dj
 
 WORKDIR /state
 EXPOSE  3923
-ENTRYPOINT ["python3", "-m", "copyparty", "-c", "/z/initcfg"]
+ENTRYPOINT ["/bin/ash", "/z/cpp.sh", "-c", "/z/initcfg"]
diff --git a/scripts/docker/Dockerfile.im b/scripts/docker/Dockerfile.im
index db94aba8..ff14be1f 100644
--- a/scripts/docker/Dockerfile.im
+++ b/scripts/docker/Dockerfile.im
@@ -18,4 +18,4 @@ RUN     ash innvikler.sh im
 
 WORKDIR /state
 EXPOSE  3923
-ENTRYPOINT ["python3", "-m", "copyparty", "-c", "/z/initcfg"]
+ENTRYPOINT ["/bin/ash", "/z/cpp.sh", "-c", "/z/initcfg"]
diff --git a/scripts/docker/Dockerfile.iv b/scripts/docker/Dockerfile.iv
index 79346a81..82bb324c 100644
--- a/scripts/docker/Dockerfile.iv
+++ b/scripts/docker/Dockerfile.iv
@@ -15,11 +15,11 @@ RUN     apk add -U !pyc \
             ffmpeg \
             py3-magic \
             vips-jxl vips-heif vips-poppler vips-magick \
-            libraw py3-numpy cython \
+            libraw py3-numpy \
         && apk add -t .bd \
             bash wget gcc g++ make cmake patchelf \
             python3-dev py3-wheel libffi-dev \
-            libraw-dev py3-numpy-dev \
+            libraw-dev py3-numpy-dev cython \
         && rm -f /usr/lib/python3*/EXTERNALLY-MANAGED \
         && python3 -m pip install pyvips \
         && python3 -m pip install "$(wget -O- https://api.github.com/repos/letmaik/rawpy/releases/latest | awk -F\" '$2=="tarball_url"{print$4}')" \
@@ -31,4 +31,4 @@ RUN     ash innvikler.sh iv
 
 WORKDIR /state
 EXPOSE  3923
-ENTRYPOINT ["python3", "-m", "copyparty", "-c", "/z/initcfg"]
+ENTRYPOINT ["/bin/ash", "/z/cpp.sh", "-c", "/z/initcfg"]
diff --git a/scripts/docker/Dockerfile.min b/scripts/docker/Dockerfile.min
index 8d8f380a..ec9aa121 100644
--- a/scripts/docker/Dockerfile.min
+++ b/scripts/docker/Dockerfile.min
@@ -15,4 +15,4 @@ RUN     ash innvikler.sh min
 
 WORKDIR /state
 EXPOSE  3923
-ENTRYPOINT ["python3", "-m", "copyparty", "--no-thumb", "-c", "/z/initcfg"]
+ENTRYPOINT ["/bin/ash", "/z/cpp.sh", "--no-thumb", "-c", "/z/initcfg"]
diff --git a/scripts/docker/README.md b/scripts/docker/README.md
index 7f4222f7..4fc66283 100644
--- a/scripts/docker/README.md
+++ b/scripts/docker/README.md
@@ -120,6 +120,7 @@ add the following three config entries into the `[global]` section of your `copy
 * `ftp: 3921` to enable the service, listening for connections on port 3921
 
 * `ftp-nat: 127.0.0.1` but replace `127.0.0.1` with the actual external IP of your server; the clients will only be able to connect to this IP, even if the server has multiple IPs
+  * do not add `ftp-nat` if you are running the container with host networking
 
 * `ftp-pr: 12000-12099` to restrict the [passive-mode](http://slacksite.com/other/ftp.html#passive) port selection range; this allows up to 100 simultaneous file transfers
 
@@ -129,3 +130,8 @@ then finally update your docker config so that the port-range you specified (120
 # build the images yourself
 
 basically `./make.sh hclean pull img push` but see [devnotes.md](./devnotes.md)
+
+
+## adding new packages to the image
+
+in case you wish to make a small modification to the official image, for example [add a python package you need](https://github.com/9001/copyparty/issues/479#issuecomment-3152026483), then you don't *really* need to build the whole image from scratch -- see [modifying an image](./devnotes.md#modifying-an-image) in devnotes
diff --git a/scripts/docker/devnotes.md b/scripts/docker/devnotes.md
index d61205cd..65d9c9d9 100644
--- a/scripts/docker/devnotes.md
+++ b/scripts/docker/devnotes.md
@@ -1,5 +1,7 @@
 # building the images yourself
 
+if you want to build the image from scratch then you've come to the right place -- however if you only want to make small modifications to the official image then jump down to [modifying an image](#modifying-an-image) or possibly [modding on the fly](#modding-on-the-fly)
+
 ```bash
 ./make.sh hclean pull img push
 ```
@@ -33,3 +35,74 @@ apk add qemu-openrc qemu-tools qemu-{arm,armeb,aarch64,s390x,ppc64le}
 rc-update add qemu-binfmt
 service qemu-binfmt start
 ```
+
+
+# modifying an image
+
+if you want to make a small change to the official image, for example [install a python package you need](https://github.com/9001/copyparty/issues/479), then the best approach is to build a new image based on the official one. There's a quick summary below, but check the internets if you want a better walkthrough.
+
+**NOTE:** the `min` image is **not** a good idea to modify (brittle from shoehorning); use any of the other variants instead (`im`, `ac`, `iv`, `dj`)
+
+first, create a new folder, and then create a new blank textfile named `Dockerfile` inside that folder:
+
+```bash
+mkdir customparty
+cd customparty
+nano Dockerfile
+```
+
+assuming you want to install the python-package "[requests](https://pypi.org/project/requests/)", which in [alpine](https://alpinelinux.org/) is called [py3-requests](https://pkgs.alpinelinux.org/package/edge/main/x86_64/py3-requests), then put the following contents into your `Dockerfile`:
+
+```docker
+FROM docker.io/copyparty/ac:latest
+RUN apk add --no-cache py3-requests
+```
+
+build the new docker-image with the additional package you added:
+
+```bash
+docker pull docker.io/copyparty/ac:latest
+docker build -t customparty .
+```
+
+now you can run the image `localhost/customparty:latest` which is `copyparty/ac:latest` with your changes
+
+**one important thing to remember:** Whenever you want to update your copyparty version, you must rebuild that image by running those two docker commands (`pull` and `build`) in that folder
+
+
+## modding on the fly
+
+if you are not able to build your own image, then it is also possible to apply *some* changes as the image is starting up, before copyparty itself is launched. This is hacky but mostly-safe if done correctly
+
+**NOTE:** the `min` image is **not** a good idea to modify (brittle from shoehorning); use any of the other variants instead (`im`, `ac`, `iv`, `dj`)
+
+you should have a docker-volume which is mapped to `/cfg` in the container; in that volume, create a shellscript named (for example) `strikk-og-binders.sh` and then ensure that the docker-container is always executed with the environment-variable `DI_PREPARTY` set to `strikk-og-binders.sh`
+
+* if you use docker-compose then see the [LD_PRELOAD](https://github.com/9001/copyparty/blob/hovudstraum/docs/examples/docker/basic-docker-compose/docker-compose.yml) example
+
+**NOTE:** if you are doing this to [install a package you need](https://github.com/9001/copyparty/issues/479), then please make sure you **do not** download the package every time you restart copyparty, because that would result in excessive strain on Alpine's poor servers. You should cache the package locally. Here's an example `strikk-og-binders.sh` with caching, using [exiftool](https://pkgs.alpinelinux.org/package/edge/community/x86_64/exiftool) and [py3-requests](https://pkgs.alpinelinux.org/package/edge/main/x86_64/py3-requests) as the example packages to install
+
+```bash
+set -e  # if something below goes wrong, then panic and crash
+#set -x  # uncomment this to debug (enable command-logging)
+
+# packages to install
+pkgs="exiftool py3-requests"
+
+# if the docker-image is newer than the cache, then delete the cache
+[ /z/initcfg -nt /cfg/apks/t ] && rm -rf /cfg/apks
+
+# if the cache has the wrong packages, then delete the cache
+grep -qF "$pkgs" /cfg/apks/t || rm -rf /cfg/apks
+
+# if there is a cache, then just install those packages (remove -q to debug)
+[ -e /cfg/apks ] && exec apk add -q --progress=no /cfg/apks/*.apk
+
+# there is no cache; need to download+cache+install
+mkdir /cfg/apks
+apk add --cache-predownload --cache-dir /cfg/apks --progress=no $pkgs
+echo "$pkgs" >/cfg/apks/t
+touch -r /z/initcfg /cfg/apks/t
+```
+
+security-wise this is safe because apk-files are signed and thus tamper-proof
diff --git a/scripts/docker/innvikler.sh b/scripts/docker/innvikler.sh
index e79ffde1..922cd410 100644
--- a/scripts/docker/innvikler.sh
+++ b/scripts/docker/innvikler.sh
@@ -38,6 +38,25 @@ cat >initcfg <<'EOF'
 % /cfg
 EOF
 
+# the bootstrap
+cat >cpp.sh <<'EOF'
+#!/bin/ash
+set -e
+[ "$DI_PREPARTY" ] && {
+  p="$DI_PREPARTY"
+  [ "$p" = "${p##*/}" ] || {
+    echo "ERROR: DI_PREPARTY must be filename only"
+    exit 1
+  }
+  echo "running DI_PREPARTY (/cfg/$p)"
+  /bin/ash "/cfg/$p" || { e=$?
+    echo "ERROR: DI_PREPARTY returned error $e"
+    exit $e
+  }
+}
+exec /usr/bin/python3 -m copyparty "$@"
+EOF
+
 # unpack sfx and dive in
 python3 copyparty-sfx.py --version
 cd /tmp/pe-copyparty.0