diff --git a/Dockerfile b/Dockerfile
index 1c3de8d..573d92e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,15 +1,17 @@
 # syntax=docker/dockerfile:1
 
 # Use full image because we need node-gyp to build native dependencies
-FROM node:20 AS build
+FROM node:20-alpine AS build
 
-RUN npm install -g pnpm@8.14.1 && npm cache clean --force
+RUN npm install -g pnpm@8.14.1 && \
+    npm cache clean --force
 
 WORKDIR /app
 
 COPY package.json package-lock.* ./
 ADD app/lib ./app/lib
-RUN pnpm install
+RUN pnpm install --ignore-scripts
+RUN pnpm add sharp
 
 # Build the application
 COPY . .
@@ -18,4 +20,6 @@ RUN pnpm build
 # ====================================
 FROM build AS release
 
-CMD ["npm", "run", "start"]
\ No newline at end of file
+# avoid using npm scripts that create sub-shells
+# calling next binary directly
+CMD ["/app/node_modules/.bin/next", "start"]
\ No newline at end of file
diff --git a/README.md b/README.md
index 38a651a..6e4d930 100644
--- a/README.md
+++ b/README.md
@@ -110,11 +110,11 @@ A related option is VS Code Dev Containers, which will open the project in your
 
 1. Install the required tools:
 
-    - [Azure Developer CLI](https://aka.ms/azure-dev/install)
-    - [Node.js 20+](https://nodejs.org/download/)
-    - [Git](https://git-scm.com/downloads)
-    - [Powershell 7+ (pwsh)](https://github.com/powershell/powershell) - For Windows users only.
-      - **Important**: Ensure you can run `pwsh.exe` from a PowerShell terminal. If this fails, you likely need to upgrade PowerShell.
+- [Azure Developer CLI](https://aka.ms/azure-dev/install)
+- [Node.js 20+](https://nodejs.org/download/)
+- [Git](https://git-scm.com/downloads)
+- [Powershell 7+ (pwsh)](https://github.com/powershell/powershell) - For Windows users only.
+  - **Important**: Ensure you can run `pwsh.exe` from a PowerShell terminal. If this fails, you likely need to upgrade PowerShell.
 
 2. Create a new folder and switch to it in the terminal.
 3. Run this command to download the project code:
@@ -151,10 +151,20 @@ azd env new
 Enter a name that will be used for the resource group.
 This will create a new folder in the `.azure` folder, and set it as the active environment for any calls to `azd` going forward.
 
-Package, provision and deploy this project to Azure:
+Provision the infrastructure needed to run the application.
 
 ```shell
-azd up
+azd provision
+```
+
+> [!IMPORTANT]
+> This application specifically requires some environment variables to be available during the packaging phase. This is why we need to provision the infra first before packaging and deploying the app. In most cases, simply running 'azd up' will package, provision and deploy your apps.
+
+Package and deploy the app to Azure:
+
+```shell
+azd package
+azd deploy
 ```
 
 > [!NOTE]
diff --git a/infra/main.bicep b/infra/main.bicep
index 7fdb74e..4a0dcf6 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -85,7 +85,8 @@ param openAiEmbedSkuName string = 'Standard'
 param chatDeploymentCapacity int = 1
 param openAiEmbeddingDeploymentCapacity int = 30
 
-param llamaIndexFileserverUrlPrefix string = 'http://localhost/api/files'
+// leave this empty will disable file URLs generated (in the UI)
+param llamaIndexFileserverUrlPrefix string = ''
 param llamaIndexCacheDir string = '.cache'
 param llamaIndexSystemPrompt string = '''
 you are an assistant. Always use data_query_engine to answer the user\'s questions, and query for documents from your data source
@@ -283,7 +284,8 @@ module openAi 'br/public:avm/res/cognitive-services/account:0.8.0' = if (!reuseE
       : '${abbrs.cognitiveServicesAccounts}${resourceToken}'
     sku: 'S0'
     deployments: openAiDeployments
-    disableLocalAuth: true
+    disableLocalAuth: false
+    restrictOutboundNetworkAccess: false
     publicNetworkAccess: 'Enabled'
     networkAcls: {
       defaultAction: 'Allow'
@@ -423,6 +425,7 @@ module openAiRoleSearchService 'core/security/role.bicep' = if (!reuseExistingSe
 // If detected, it will be used to authenticate the user 
 // using a user-assigned managed identity on Azure.
 // However, this is not supported in local development.
+output AZURE_CLIENT_ID string = acaIdentity.outputs.clientId
 
 output AZURE_LOCATION string = location
 output AZURE_TENANT_ID string = tenantId
diff --git a/package.json b/package.json
index ad27c65..1a6a6f3 100644
--- a/package.json
+++ b/package.json
@@ -4,11 +4,11 @@
   "scripts": {
     "format": "prettier --ignore-unknown --cache --check .",
     "format:write": "prettier --ignore-unknown --write .",
-    "dev": "next dev",
+    "dev": "AZURE_CLIENT_ID= next dev",
     "build": "next build",
     "start": "next start",
     "lint": "next lint",
-    "generate": "tsx app/api/chat/engine/generate.ts"
+    "generate": "AZURE_CLIENT_ID= tsx app/api/chat/engine/generate.ts"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.1.0",