diff --git a/docker/Dockerfile b/docker/Dockerfile
index 480244127..205fa7ced 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -33,11 +33,14 @@ COPY --from=builder /src/build/picoclaw /usr/local/bin/picoclaw
 RUN addgroup -g 1000 picoclaw && \
     adduser -D -u 1000 -G picoclaw picoclaw
 
+# Copy entrypoint script
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 # Switch to non-root user
 USER picoclaw
 
 # Run onboard to create initial directories and config
 RUN /usr/local/bin/picoclaw onboard
 
-ENTRYPOINT ["picoclaw"]
-CMD ["gateway"]
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/docker/Dockerfile.full b/docker/Dockerfile.full
index 30e1680d5..9432031c0 100644
--- a/docker/Dockerfile.full
+++ b/docker/Dockerfile.full
@@ -37,8 +37,11 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
 # Copy binary
 COPY --from=builder /src/build/picoclaw /usr/local/bin/picoclaw
 
+# Copy entrypoint script
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 # Create picoclaw home directory
 RUN /usr/local/bin/picoclaw onboard
 
-ENTRYPOINT ["picoclaw"]
-CMD ["gateway"]
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/docker/Dockerfile.heavy b/docker/Dockerfile.heavy
index cbc243e39..f7adf1b7c 100644
--- a/docker/Dockerfile.heavy
+++ b/docker/Dockerfile.heavy
@@ -53,6 +53,10 @@ RUN deluser node 2>/dev/null; delgroup node 2>/dev/null; \
     addgroup -g 1000 picoclaw 2>/dev/null; \
     adduser -D -u 1000 -G picoclaw -h /home/picoclaw picoclaw 2>/dev/null || true
 
+# Copy entrypoint script
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 USER picoclaw
 
 # Run onboard to create initial directories and config
@@ -63,5 +67,4 @@ COPY --chown=picoclaw:picoclaw workspace/ /home/picoclaw/.picoclaw/workspace/
 
 VOLUME /home/picoclaw/.picoclaw/workspace
 
-ENTRYPOINT ["picoclaw"]
-CMD ["gateway"]
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/workspace/AGENT.md b/workspace/AGENT.md
index 08f55a1b7..280870aa7 100644
--- a/workspace/AGENT.md
+++ b/workspace/AGENT.md
@@ -43,3 +43,11 @@ be practical, accurate, and efficient.
 - Improve through feedback and continued iteration
 
 Read `SOUL.md` as part of your identity and communication style.
+
+## Docker Bootstrap
+
+When running inside Docker, a script at `~/.picoclaw/workspace/bootstrap.sh` runs automatically on every container start. You can modify this file to install tools that persist across restarts.
+
+- **Install a tool**: add an idempotent install command to `bootstrap.sh` (check if already installed before installing)
+- **Check for errors**: if a previous bootstrap failed, read `~/.picoclaw/workspace/bootstrap.error.log` — it contains the full error output
+- **Changes take effect**: on the next container restart (the script runs before the gateway starts)