diff --git a/README.md b/README.md
index 042f72c7fa..eb4dab51cc 100644
--- a/README.md
+++ b/README.md
@@ -90,9 +90,9 @@ Generation or repair completing does not mean every candidate passes. Inspect bo
 
 ## Docker
 
-Run `docker/docker-build` from the repository root to prepare an image with the required toolchain. Mirrors can be configured in `docker/Dockerfile` if needed.
+Run `docker/docker-build` to prepare an image with the pinned analysis toolchain, Python, and cargo-llvm-cov. Both Docker scripts locate the repository from their own paths. Mirrors can be configured in `docker/Dockerfile` if needed.
 
-Run `docker/docker-run` from the same directory to mount the repository at `/home/palm/palm` in the container. In the container, change to that directory and follow [Installation](#installation).
+Run `docker/docker-run` to open a shell in the repository mounted at `/home/palm/palm`, then follow [Installation](#installation). The container is removed when the shell exits; files written in the mounted repository remain on the host. Use working copies of target crates as described above.
 
 ## Development checks
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 0176e8b5e9..b36d48f9a9 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -14,7 +14,7 @@ ARG TARGETARCH
 RUN apt update && apt upgrade -y \
     && apt install -y ca-certificates \
     # Install packages
-    && apt install -y build-essential git curl wget vim \
+    && apt install -y build-essential git curl wget vim python3 \
     sudo \
     zsh zsh-autosuggestions zsh-syntax-highlighting \
     && rm -rf /var/lib/apt/lists/* \
@@ -26,6 +26,7 @@ RUN apt update && apt upgrade -y \
 
 USER $USERNAME
 WORKDIR /home/$USERNAME
+ENV PATH="/home/${USERNAME}/.cargo/bin:${PATH}"
 
 RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" \
     && sed -i 's/^ZSH_THEME=.*/ZSH_THEME="ys"/' ~/.zshrc \
@@ -36,10 +37,12 @@ RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master
     && . "$HOME/.cargo/env" \
     # Set mirror for crates.io
     # ...
-    && rustup install nightly-2025-03-19 \
-    && rustup component add --toolchain nightly-2025-03-19 rust-src rustc-dev llvm-tools-preview \
-    && host=$(rustc -vV | grep '^host:' | cut -d' ' -f2); \
-    curl --proto '=https' --tlsv1.2 -fsSL \
+    && rustup toolchain install nightly-2025-03-19 --profile minimal \
+        --component rust-src --component rustc-dev --component llvm-tools-preview --component rust-analyzer \
+    && rustup default nightly-2025-03-19
+
+RUN host=$(rustc -vV | grep '^host:' | cut -d' ' -f2) \
+    && curl --proto '=https' --tlsv1.2 -fsSL \
     "https://github.com/taiki-e/cargo-llvm-cov/releases/download/v0.6.16/cargo-llvm-cov-$host.tar.gz" \
     | tar xzf - -C "$HOME/.cargo/bin"
 
diff --git a/docker/docker-build b/docker/docker-build
index 0b161043a3..21496a3667 100755
--- a/docker/docker-build
+++ b/docker/docker-build
@@ -1,12 +1,14 @@
-#!/usr/bin/bash
-set -e
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 
 readonly DOCKER_IMAGE_NAME="palm"
-readonly DOCKER_FILE="docker/Dockerfile"
+readonly DOCKER_FILE="$repo_root/docker/Dockerfile"
 readonly DOCKER_USER="palm"
 
 docker build \
-    -t $DOCKER_IMAGE_NAME \
-    -f $DOCKER_FILE \
+    -t "$DOCKER_IMAGE_NAME" \
+    -f "$DOCKER_FILE" \
     --build-arg=USERNAME="$DOCKER_USER" \
-    . 1>&2
+    "$repo_root/docker" 1>&2
diff --git a/docker/docker-run b/docker/docker-run
index 85f2014bcd..eab1bbe862 100755
--- a/docker/docker-run
+++ b/docker/docker-run
@@ -1,11 +1,10 @@
-#!/usr/bin/bash
+#!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-readonly DOCKER_USER="palm"
-readonly CONTAINER_NAME="palm"
-readonly PWD=`pwd`
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
 
-docker run -it \
-    -v "${PWD}:/home/${DOCKER_USER}/palm" \
-    --name "${CONTAINER_NAME}" palm
+readonly DOCKER_USER="palm"
+docker run --rm -it \
+    -v "${repo_root}:/home/${DOCKER_USER}/palm" \
+    -w "/home/${DOCKER_USER}/palm" palm