diff --git a/README.md b/README.md
index fdaea9e..a6d5568 100644
--- a/README.md
+++ b/README.md
@@ -19,3 +19,16 @@ Only MP3/M4B files can be played in a browser; convert Audible `.aax`/`.aaxc` bo
 - Credentials and user data live in `config.json`, `users.json`, `sessions.json`, `progress_users.json` (git-ignored).
 - Only read-only OpenAudible endpoints are proxied; admin commands and import are blocked.
 - Traffic is plain HTTP. Use a VPN (e.g. Tailscale) or a TLS reverse proxy for access outside your home network.
+
+## Docker
+
+```bash
+# .env next to docker-compose.yml
+OPENAUDIBLE_USER=...
+OPENAUDIBLE_PASSWORD=...
+PLAYER_USER=nate          # default account, created on first start
+PLAYER_PASSWORD=...
+```
+
+`docker compose up -d`, then sign in at port 8080. The default account is only created if it doesn't exist, so changing its password later with
+`docker exec -it audiobook-player python server.py passwd nate` sticks. Add more people with `adduser`.
diff --git a/docker-compose.yml b/docker-compose.yml
index cb85d16..e8cd35f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,6 +10,8 @@ services:
       OPENAUDIBLE_URL: http://172.16.16.106:8000
       OPENAUDIBLE_USER: ${OPENAUDIBLE_USER}          # put these in a .env file next to this one
       OPENAUDIBLE_PASSWORD: ${OPENAUDIBLE_PASSWORD}
+      PLAYER_USER: ${PLAYER_USER}                    # default account, created on first start
+      PLAYER_PASSWORD: ${PLAYER_PASSWORD}
     volumes:
       - player-data:/data    # accounts, sessions, listening progress
 
diff --git a/server.py b/server.py
index 9f14362..8f98680 100644
--- a/server.py
+++ b/server.py
@@ -317,8 +317,18 @@ def serve(argv):
     ap.add_argument("--port", type=int, default=int(os.environ.get("PORT", 8080)))
     ap.add_argument("--host", default="0.0.0.0")
     a = ap.parse_args(argv)
-    if not read(F_USERS, {}):
-        sys.exit("No accounts yet. Run: python3 server.py adduser YOURNAME")
+    users = read(F_USERS, {})
+    du, dp = os.environ.get("PLAYER_USER", "").strip().lower(), os.environ.get("PLAYER_PASSWORD", "")
+    if du and dp and du not in users:  # default account for containers; never overwrites an existing one
+        users[du] = hash_pw(dp)
+        write(F_USERS, users, private=True)
+        if len(users) == 1 and os.path.exists(F_LEGACY):
+            legacy = read(F_LEGACY, {})
+            if legacy and all(isinstance(v, dict) and "pos" in v for v in legacy.values()):
+                write(F_PROGRESS, {du: legacy})
+        print(f"Created default account '{du}'.")
+    if not users:
+        sys.exit("No accounts yet. Run: python3 server.py adduser NAME (or set PLAYER_USER and PLAYER_PASSWORD)")
     if not oa_login()[0]:
         print("Note: no OpenAudible login set. Run `python3 server.py setup` or set OPENAUDIBLE_USER/OPENAUDIBLE_PASSWORD.")
     Handler.upstream = a.upstream.rstrip("/")