diff --git a/CHANGELOG.md b/CHANGELOG.md
index a05cc1e..6a15f4c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,10 @@ All notable changes to kage are recorded here. The format follows
 
 - Clearer crawl error reporting. Each failure is logged with a classified reason (`HTTP 403 Forbidden`, `timed out`, ...), the URL, and the page that referenced it, and the end-of-run summary lists what went wrong instead of printing only a count.
 
+### Fixed
+
+- The container image now runs. Chrome aborted on launch with `chrome_crashpad_handler: --database is required`, so kage disables Chrome's crash reporter inside a container, and the `kage` user now has a writable home (the mounted `/out` volume) so the default output, resume state, and Chrome's profile no longer fail with a permission error (issue #7).
+
 ## [0.1.1] - 2026-06-14
 
 ### Added
diff --git a/Dockerfile b/Dockerfile
index 7b20f98..c9347b5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,7 +29,14 @@ WORKDIR /out
 # Point kage at the bundled Chromium and write mirrors under /out by default:
 #
 #   docker run -v "$PWD/out:/out" ghcr.io/tamnd/kage clone example.com
-ENV KAGE_CHROME=/usr/bin/chromium-browser
+#
+# The kage user has no home directory of its own, so HOME points at the mounted
+# /out volume. That keeps two things writable: kage's default output and resume
+# state (it lands under $HOME/data/kage), and Chrome's profile and crash
+# database. Without this both fail with a permission error in the container
+# (issue #7), and the mounted volume captures nothing.
+ENV KAGE_CHROME=/usr/bin/chromium-browser \
+    HOME=/out
 
 VOLUME ["/out"]
 
diff --git a/browser/pool.go b/browser/pool.go
index 9a9de2f..e457ec0 100644
--- a/browser/pool.go
+++ b/browser/pool.go
@@ -146,8 +146,13 @@ func (p *Pool) getBrowser() (*rod.Browser, error) {
 		// In a container, the default /dev/shm is only 64 MB, too small for
 		// Chrome's renderer on large pages, so steer it to a temp file instead.
 		// Outside a container /dev/shm is roomy and faster, so leave it alone.
+		// Chrome's crashpad handler also aborts with "--database is required" in a
+		// minimal container, which fails the whole launch (issue #7), so turn the
+		// crash reporter off there. kage never uploads Chrome crash dumps anyway.
 		if inContainer() {
-			l = l.Set("disable-dev-shm-usage", "")
+			l = l.Set("disable-dev-shm-usage", "").
+				Set("disable-crash-reporter", "").
+				Set("disable-breakpad", "")
 		}
 
 		if bin := p.chromeBin(); bin != "" {