diff --git a/src/build/cli.cr b/src/build/cli.cr
index 968db9c..529a882 100644
--- a/src/build/cli.cr
+++ b/src/build/cli.cr
@@ -40,6 +40,10 @@ module DocMachine::Build
           config.enable_tty = true
         end
 
+        opts.on("-i", "--image", "Use specific image:tag (default glenux/docmachine:latest)") do |image_tag|
+          config.image_tag = image_tag
+        end
+
         commands << ->() : Nil do
           app = DocMachine::Build::Run.new(config)
           app.prepare
diff --git a/src/build/config.cr b/src/build/config.cr
index ec33c4d..d65fcef 100644
--- a/src/build/config.cr
+++ b/src/build/config.cr
@@ -7,6 +7,7 @@ module DocMachine::Build
     property port : Int32 = 5100
     property enable_multiple : Bool = false
     property enable_cache : Bool = false
+    property image_tag : String = "glenux/docmachine:latest"
 
     def initialize(@parent : DocMachine::Config)
     end
diff --git a/src/build/run.cr b/src/build/run.cr
index 89ed74e..b5fcd3a 100644
--- a/src/build/run.cr
+++ b/src/build/run.cr
@@ -15,7 +15,6 @@ module DocMachine::Build
       data = "#{@config.data_dir}:#{@config.port}"
       @basehash = Digest::SHA256.hexdigest(data)[0..6]
       @docker_name = "docmachine-#{@basehash}"
-      @docker_image = "glenux/docmachine:latest"
       @docker_opts = [] of String
       @process = nil
     end
@@ -25,7 +24,7 @@ module DocMachine::Build
     # setup permissions
     def prepare()
       Log.info { "basedir      = #{@config.data_dir}" }
-      Log.info { "docker_image = #{@docker_image}" }
+      Log.info { "docker_image = #{@config.image_tag}" }
       Log.info { "action       = #{@config.action}" }
 
       self._pull_image()
@@ -56,13 +55,13 @@ module DocMachine::Build
       data_cache_file = data_cache_dir  / "image.tar"
       Log.info { "Checking cache #{data_cache_file}..." }
       if ! File.exists? data_cache_file.to_s
-        Log.info { "Downloading #{@docker_image} image..." }
-        Process.run("docker", ["pull", @docker_image], output: STDOUT)
+        Log.info { "Downloading #{@config.image_tag} image..." }
+        Process.run("docker", ["pull", @config.image_tag], output: STDOUT)
         Log.info { "Building cache for image (#{data_cache_dir})" }
         FileUtils.mkdir_p(data_cache_dir)
         status = Process.run(
           "docker", 
-          ["image", "save", @docker_image, "-o", data_cache_file.to_s], 
+          ["image", "save", @config.image_tag, "-o", data_cache_file.to_s], 
           output: STDOUT
         )
         if status.success? 
@@ -77,7 +76,7 @@ module DocMachine::Build
       end
 
       if @config.enable_cache
-        Log.info { "Loading #{@docker_image} image from cache..." }
+        Log.info { "Loading #{@config.image_tag} image from cache..." }
         docker_image_loaded = false
         status = Process.run(
           "docker", 
@@ -91,16 +90,34 @@ module DocMachine::Build
           exit 1
         end
       else
-        Log.info { "Loading #{@docker_image} image from local registry..." }
+        Log.info { "Loading #{@config.image_tag} image from local registry..." }
         # FIXME: check that local image exists
       end
     end
 
     def start()
-      uid = %x{id -u}.strip
-      gid = %x{id -g}.strip
-      Log.info { "uid: #{uid}" }
-      Log.info { "cid: #{gid}" }
+      # start with default uid/gid
+      ext_uid = %x{id -u}.strip.to_i
+      ext_gid = %x{id -g}.strip.to_i
+
+      # ...but use subuid/subgid if available
+      File.each_line("/etc/subuid") do |line|
+        split = line.split(":")
+        next if split[0] != %x{id -u -n}
+
+        subuid = split[1].to_i 
+        ext_uid += subuid - 1
+      end
+      File.each_line("/etc/subgid") do |line|
+        split = line.split(":")
+        next if split[0] != %x{id -g -n}
+
+        subgid = split[1].to_i
+        ext_gid += subgid - 1
+      end
+
+      Log.info { "ext uid: #{ext_uid}" }
+      Log.info { "ext cid: #{ext_gid}" }
 
       docker_opts = [] of String
       docker_opts << "run"
@@ -111,8 +128,9 @@ module DocMachine::Build
       docker_opts.concat ["--name", @docker_name]
       docker_opts << "--rm"
       docker_opts << "--shm-size=1gb"
-      docker_opts.concat ["-e", "EXT_UID=#{uid}"]
-      docker_opts.concat ["-e", "EXT_GID=#{gid}"]
+      # docker_opts << "--privileged"
+      docker_opts.concat ["-e", "EXT_UID=#{ext_uid}"]
+      docker_opts.concat ["-e", "EXT_GID=#{ext_gid}"]
       docker_opts.concat ["-v", "#{@config.data_dir}/docs:/app/docs"]
       docker_opts.concat ["-v", "#{@config.data_dir}/slides:/app/slides"]
       docker_opts.concat ["-v", "#{@config.data_dir}/images:/app/images"]
@@ -166,11 +184,14 @@ module DocMachine::Build
         Log.info { "Slides: no slides directory detected." }
         end
 
-      docker_opts << @docker_image
+      docker_opts << @config.image_tag
       docker_opts << @config.action
 
-      Log.info { docker_opts.inspect.colorize(:yellow) }
-      @process = Process.new("docker", docker_opts, output: STDOUT, error: STDERR)
+      Log.info { 
+        docker_str = ["docker"].concat(docker_opts).join(" ").colorize(:yellow)
+        "Docker: #{docker_str.to_s}"
+      }
+      @process = Process.new("docker", docker_opts, input: STDIN, output: STDOUT, error: STDERR)
     end
 
     def wait()