diff --git a/Dockerfile b/Dockerfile
index 9d10c60..bb47c80 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,4 @@
 # syntax=docker/dockerfile:1.4
-# beep
 FROM --platform=$BUILDPLATFORM chimeralinux/chimera:latest AS builder
 ARG TARGETOS
 ARG TARGETARCH
@@ -18,11 +17,49 @@ RUN CGO_ENABLED=0 \
       -gcflags="all=-l" \
       -o /pinata ./main.go
 
+
 FROM chimeralinux/chimera:latest AS runtime
+
+RUN apk add --no-cache ca-certificates dnsmasq util-linux
+
 COPY --from=builder /pinata /pinata
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-USER 65532
+
+RUN mkdir -p /run
+
+RUN cat > /entrypoint.sh <<'EOF'
+#!/bin/sh
+set -eu
+
+UPSTREAM="/run/dnsmasq.resolv"
+
+cp /etc/resolv.conf "$UPSTREAM" || true
+
+printf "nameserver 127.0.0.1\noptions timeout:1 attempts:1\n" > /etc/resolv.conf
+
+dnsmasq \
+  --no-daemon \
+  --listen-address=127.0.0.1 \
+  --bind-interfaces \
+  --cache-size=10000 \
+  --neg-ttl=60 \
+  --resolv-file="$UPSTREAM" \
+  --log-facility=- &
+
+DNSMASQ_PID=$!
+trap 'kill $DNSMASQ_PID 2>/dev/null || true' EXIT INT TERM
+
+sleep 0.5
+
+# Drop privileges (Chimera-compatible)
+exec setpriv --reuid=65532 --regid=65532 --clear-groups /pinata
+EOF
+
+RUN chmod +x /entrypoint.sh
+
 EXPOSE 8080
+
 ENV GOMEMLIMIT=8MiB \
     GOGC=20
-ENTRYPOINT ["/pinata"]
\ No newline at end of file
+
+ENTRYPOINT ["/entrypoint.sh"]
\ No newline at end of file