diff --git a/.dockerignore b/.dockerignore
index 9e837f1..7719c78 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -11,11 +11,10 @@ client/node_modules/
 client/dist/
 client/.vite/
 
-# VCS / docs / local
+# VCS / docs / local  (.editorconfig is NOT ignored — the in-container build needs its analyzer rules)
 .git/
 .gitignore
 .gitattributes
 *.md
 docs/
-.editorconfig
 **/appsettings.*.local.json
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 5250d24..2533a96 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -11,6 +11,8 @@
 FROM mirror.soroushasadi.com/node:22-bookworm-slim AS client
 WORKDIR /client
 COPY client/package.json client/package-lock.json ./
+# npm packages from npmjs.org (reachable from this machine; the Nexus npm proxy 404s on some
+# packages). If npmjs.org is blocked at build time, add: --registry <a working npm proxy>.
 RUN npm ci
 COPY client/ ./
 RUN npm run build
@@ -18,7 +20,7 @@ RUN npm run build
 # ---- Stage 2: restore + publish BOTH hosts into /app ----
 FROM mirror.soroushasadi.com/dotnet/sdk:10.0 AS build
 WORKDIR /src
-COPY Directory.Build.props Directory.Packages.props nuget.config global.json ./
+COPY Directory.Build.props Directory.Packages.props nuget.config global.json .editorconfig ./
 COPY src/ ./src/
 RUN dotnet restore src/Hosts/TeamUp.Web/TeamUp.Web.csproj
 RUN dotnet restore src/Hosts/TeamUp.Worker/TeamUp.Worker.csproj
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index cfb6356..40a7a29 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -11,7 +11,8 @@ services:
       POSTGRES_USER: teamup
       POSTGRES_PASSWORD: teamup
     ports:
-      - "5432:5432"
+      # Host port is configurable to avoid clashes with other local Postgres instances.
+      - "${POSTGRES_HOST_PORT:-5432}:5432"
     volumes:
       - pgdata:/var/lib/postgresql/data
       - ./postgres-init.sh:/docker-entrypoint-initdb.d/01-init-vector.sh:ro
@@ -34,7 +35,7 @@ services:
       # The web role applies migrations; the worker waits (EF's DB-wide lock makes it safe either way).
       Database__ApplyMigrationsOnStartup: "true"
     ports:
-      - "8080:8080"
+      - "${WEB_HOST_PORT:-8080}:8080"
     depends_on:
       postgres:
         condition: service_healthy