diff --git a/Dockerfile b/Dockerfile
index c41c415e..0651b7d2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -31,14 +31,18 @@ ENV HOST=0.0.0.0 \
     MCP_AUTO_OPEN_ENABLED=false
 EXPOSE 6274
 
-# Run as the non-root `node` user the base image ships. Its home (/home/node) is
-# where the inspector writes runtime state (the default catalog, OAuth token
-# storage), so use it as the working directory.
+# Run as the non-root `node` user the base image ships. The inspector resolves
+# its runtime-state dir (default catalog, OAuth token storage) from `HOME`
+# (core/storage/store-io.ts), so set it explicitly to the node user's writable
+# home and work from there.
+ENV HOME=/home/node
 USER node
 WORKDIR /home/node
 
 # Report readiness by probing the served SPA (`/` needs no auth). Uses Node's
-# global fetch — no curl/wget in the slim image.
+# global fetch — no curl/wget in the slim image. Assumes the default `--web`
+# mode; running `--cli`/`--tui` has no web server, so add `--no-healthcheck` to
+# `docker run` for those.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
     CMD node -e "fetch('http://127.0.0.1:'+(process.env.CLIENT_PORT||6274)+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
 
diff --git a/README.md b/README.md
index 91f3e518..1cc32ed6 100644
--- a/README.md
+++ b/README.md
@@ -178,7 +178,7 @@ docker build -t mcp-inspector .
 docker run --rm -p 6274:6274 mcp-inspector
 ```
 
-The image defaults to `--web` bound to `0.0.0.0:6274` with browser auto-open disabled; override the args to run another mode (`docker run --rm ghcr.io/modelcontextprotocol/inspector --cli …`). Pass `-e MCP_INSPECTOR_API_TOKEN=…` to set a known token (otherwise one is generated and printed in the logs), or `-e DANGEROUSLY_OMIT_AUTH=true` to disable auth.
+The image defaults to `--web` bound to `0.0.0.0:6274` with browser auto-open disabled; override the args to run another mode (`docker run --rm ghcr.io/modelcontextprotocol/inspector --cli …`). Pass `-e MCP_INSPECTOR_API_TOKEN=…` to set a known token (otherwise one is generated and printed in the logs), or `-e DANGEROUSLY_OMIT_AUTH=true` to disable auth. The image runs as the non-root `node` user and has a `HEALTHCHECK` that probes the web UI — it assumes the default `--web` mode, so add `--no-healthcheck` when running `--cli`/`--tui` (which have no web server).
 
 ## Contributing — `AGENTS.md` and `CLAUDE.md`