diff --git a/Dockerfile b/Dockerfile
index 1104a62..a4cf774 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,10 +13,10 @@ RUN unzip netdisk-fast-download-bin.zip && \
     chmod +x run.sh && \
     mkdir -p db logs
 
+COPY ./docker-entrypoint.sh /docker-entrypoint.sh
+RUN chmod +x /docker-entrypoint.sh
+
 EXPOSE 6400 6401
 
-RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser && \
-    chown -R appuser:appgroup /app
-USER appuser
-
-ENTRYPOINT ["sh", "run.sh"]
+RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
+ENTRYPOINT ["/docker-entrypoint.sh"]
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
new file mode 100644
index 0000000..762ca39
--- /dev/null
+++ b/docker-entrypoint.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+set -e
+
+# Fix permissions on volume-mounted directories (runs as root)
+chown -R appuser:appgroup /app/db /app/logs /app/resources 2>/dev/null || true
+
+# Run Java directly - entrypoint is PID 1, exec makes Java PID 1
+# Docker SIGTERM goes directly to Java, triggering ShutdownHook
+exec java -Xmx${JVM_XMX:-512M} ${JVM_OPTS} -jar /app/netdisk-fast-download.jar