diff --git a/aria2/Dockerfile b/aria2/Dockerfile
index 8199279..61e8c94 100644
--- a/aria2/Dockerfile
+++ b/aria2/Dockerfile
@@ -5,7 +5,7 @@
 FROM debian:jessie
 MAINTAINER kev <noreply@datageek.info>
 
-ENV DIR   /var/lib/aria2
+ENV DIR   /home/aria2
 ENV ETC   /etc/aria2
 ENV CRT   $ETC/server.crt
 ENV KEY   $ETC/server.key
@@ -14,12 +14,16 @@ ENV PORT  6800
 
 RUN apt-get update \
     && apt-get install -y aria2 \
-    && rm -rf /var/lib/apt/lists/* \
-    && mkdir -p $ETC $DIR
+    && rm -rf /var/lib/apt/lists/*
+
+RUN useradd aria2 \
+    && mkdir -p $ETC $DIR \
+    && chown aria2:aria2 $DIR
 
 EXPOSE $PORT
 VOLUME $DIR $ETC
 
+USER aria2
 CMD aria2c --disable-ipv6            \
            --enable-rpc              \
            --rpc-listen-all          \
diff --git a/aria2/README.md b/aria2/README.md
index 2df27bb..e6617e7 100644
--- a/aria2/README.md
+++ b/aria2/README.md
@@ -19,7 +19,7 @@ aria2:
   ports:
     - "6800:6800"
   volumes:
-    - "data:/var/lib/aria2"
+    - "data:/home/aria2"
     - "keys:/etc/aria2"
   environment:
     - TOKEN=e6c3778f-6361-4ed0-b126-f2cf8fca06db
@@ -33,14 +33,15 @@ $ mkdir -p ~/fig/aria2/{data,keys}/
 $ cd ~/fig/aria2/
 $ vim docker-compose.yml
 $ openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout keys/server.key -out keys/server.crt
-$ cp ./keys/server.crt /usr/local/share/ca-certificates/
-$ update-ca-certificates --fresh
 $ fig up -d
 ```
 
 ## client
 
 ```
+$ scp server:fig/aria2/keys/server.crt /usr/local/share/ca-certificates/
+$ update-ca-certificates --fresh
+
 $ uuidgen
 3c5323b8-79f7-49d4-8303-fcfe51488db5