diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4dcee0f..a5c5bdb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,8 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     needs: pytest
+    env:
+      DEFAULT_VARIANT: alpine
     strategy:
       fail-fast: false
       matrix:
@@ -45,14 +47,19 @@ jobs:
             # Do not push to ghcr.io on PRs due to permission issues
             ghcr.io/${{ github.repository }},enable=${{ github.event_name != 'pull_request' }} 
           tags: |
-            type=raw,value=latest,enable=${{ matrix.variant == 'alpine' && github.ref_name == github.event.repository.default_branch }}
-            type=raw,value=dev,enable=${{ matrix.variant == 'alpine' && github.ref_name == 'dev' }}
+            type=raw,value=latest,enable=${{ matrix.variant == env.DEFAULT_VARIANT && github.ref_name == github.event.repository.default_branch }}
+            type=raw,value=dev,enable=${{ matrix.variant == env.DEFAULT_VARIANT && github.ref_name == 'dev' }}
             type=raw,value=latest,suffix=-${{ matrix.variant }},enable={{ is_default_branch }}
             type=ref,event=branch,suffix=-${{ matrix.variant }}
+            type=ref,event=branch,enable=${{ matrix.variant == env.DEFAULT_VARIANT }}
             type=ref,event=pr,suffix=-${{ matrix.variant }}
+            type=ref,event=pr,enable=${{ matrix.variant == env.DEFAULT_VARIANT }}
             type=semver,pattern={{ version }},suffix=-${{ matrix.variant }}
+            type=semver,pattern={{ version }},enable=${{ matrix.variant == env.DEFAULT_VARIANT }}
             type=semver,pattern={{ major }}.{{ minor }},suffix=-${{ matrix.variant }}
+            type=semver,pattern={{ major }}.{{ minor }},enable=${{ matrix.variant == env.DEFAULT_VARIANT }}
             type=sha,suffix=-${{ matrix.variant }}
+            type=sha,enable=${{ matrix.variant == env.DEFAULT_VARIANT }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
diff --git a/Dockerfile.alpine b/Dockerfile.alpine
index 22cc341..03f432a 100644
--- a/Dockerfile.alpine
+++ b/Dockerfile.alpine
@@ -32,12 +32,20 @@ ENV WHITELIST_LIBRARY_TYPE  ''
 ENV BLACKLIST_USERS  ''
 ENV WHITELIST_USERS  ''
 
+
+RUN addgroup --system jellyplex_user && \
+    adduser --system --no-create-home jellyplex_user --ingroup jellyplex_user && \
+    mkdir -p /app && \
+    chown -R jellyplex_user:jellyplex_user /app
+
 WORKDIR /app
 
-COPY ./requirements.txt ./
+COPY --chown=jellyplex_user:jellyplex_user ./requirements.txt ./
 
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+COPY --chown=jellyplex_user:jellyplex_user . .
+
+USER jellyplex_user
 
 CMD ["python", "-u", "main.py"]
diff --git a/Dockerfile.slim b/Dockerfile.slim
index ee524fe..59c9a02 100644
--- a/Dockerfile.slim
+++ b/Dockerfile.slim
@@ -32,12 +32,20 @@ ENV WHITELIST_LIBRARY_TYPE  ''
 ENV BLACKLIST_USERS  ''
 ENV WHITELIST_USERS  ''
 
+
+RUN addgroup --system jellyplex_user && \
+    adduser --system --no-create-home jellyplex_user --ingroup jellyplex_user && \
+    mkdir -p /app && \
+    chown -R jellyplex_user:jellyplex_user /app
+
 WORKDIR /app
 
-COPY ./requirements.txt ./
+COPY --chown=jellyplex_user:jellyplex_user ./requirements.txt ./
 
 RUN pip install --no-cache-dir -r requirements.txt
 
-COPY . .
+COPY --chown=jellyplex_user:jellyplex_user . .
+
+USER jellyplex_user
 
 CMD ["python", "-u", "main.py"]
diff --git a/README.md b/README.md
index e0f3f9a..8b6cfdd 100644
--- a/README.md
+++ b/README.md
@@ -42,89 +42,7 @@ Keep in sync all your users watched history between jellyfin and plex servers lo
 
 ## Configuration
 
-```bash
-# Global Settings
-
-## Do not mark any shows/movies as played and instead just output to log if they would of been marked.
-DRYRUN = "True"
-
-## Additional logging information
-DEBUG = "False"
-
-## Debugging level, "info" is default, "debug" is more verbose
-DEBUG_LEVEL = "info"
-
-## If set to true then the script will only run once and then exit
-RUN_ONLY_ONCE = "False"
-
-## How often to run the script in seconds
-SLEEP_DURATION = "3600"
-
-## Log file where all output will be written to
-LOGFILE = "log.log"
-
-## Timeout for requests for jellyfin
-REQUEST_TIMEOUT = 300
-
-## Map usernames between servers in the event that they are different, order does not matter
-## Comma separated for multiple options
-USER_MAPPING = { "testuser2": "testuser3", "testuser1":"testuser4" }
-
-## Map libraries between servers in the even that they are different, order does not matter
-## Comma separated for multiple options
-LIBRARY_MAPPING = { "Shows": "TV Shows", "Movie": "Movies" }
-
-## Blacklisting/Whitelisting libraries, library types such as Movies/TV Shows, and users. Mappings apply so if the mapping for the user or library exist then both will be excluded.
-## Comma separated for multiple options
-BLACKLIST_LIBRARY = ""
-WHITELIST_LIBRARY = ""
-BLACKLIST_LIBRARY_TYPE = ""
-WHITELIST_LIBRARY_TYPE = ""
-BLACKLIST_USERS = ""
-WHITELIST_USERS = "testuser1,testuser2"
-
-
-
-# Plex
-
-## Recommended to use token as it is faster to connect as it is direct to the server instead of going through the plex servers
-## URL of the plex server, use hostname or IP address if the hostname is not resolving correctly
-## Comma separated list for multiple servers
-PLEX_BASEURL = "http://localhost:32400, https://nas:32400"
-
-## Plex token https://support.plex.tv/articles/204059436-finding-an-authentication-token-x-plex-token/
-## Comma separated list for multiple servers
-PLEX_TOKEN = "SuperSecretToken, SuperSecretToken2"
-
-## If not using plex token then use username and password of the server admin along with the servername
-## Comma separated for multiple options
-#PLEX_USERNAME = "PlexUser, PlexUser2"
-#PLEX_PASSWORD = "SuperSecret, SuperSecret2"
-#PLEX_SERVERNAME = "Plex Server1, Plex Server2"
-
-## Skip hostname validation for ssl certificates.
-## Set to True if running into ssl certificate errors
-SSL_BYPASS = "False"
-
-
-## control the direction of syncing. e.g. SYNC_FROM_PLEX_TO_JELLYFIN set to true will cause the updates from plex
-## to be updated in jellyfin. SYNC_FROM_PLEX_TO_PLEX set to true will sync updates between multiple plex servers
-SYNC_FROM_PLEX_TO_JELLYFIN = "True"
-SYNC_FROM_JELLYFIN_TO_PLEX = "True"
-SYNC_FROM_PLEX_TO_PLEX = "True"
-SYNC_FROM_JELLYFIN_TO_JELLYFIN = "True"
-
-
-# Jellyfin
-
-## Jellyfin server URL, use hostname or IP address if the hostname is not resolving correctly
-## Comma separated list for multiple servers
-JELLYFIN_BASEURL = "http://localhost:8096, http://nas:8096"
-
-## Jellyfin api token, created manually by logging in to the jellyfin server admin dashboard and creating an api key
-## Comma separated list for multiple servers
-JELLYFIN_TOKEN = "SuperSecretToken, SuperSecretToken2"
-```
+Full list of configuration options can be found in the [.env.sample](.env.sample)
 
 ## Installation