diff --git a/Dockerfile b/Dockerfile
index d9e967b26..520814881 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -76,4 +76,4 @@ EXPOSE 3000
 ENV HOSTNAME=0.0.0.0
 ENV PORT=3000
 
-CMD ["npm", "run", "start-docker"]
+CMD ["sh", "scripts/start-docker.sh"]
diff --git a/scripts/start-docker.sh b/scripts/start-docker.sh
new file mode 100755
index 000000000..2ad0c3c2e
--- /dev/null
+++ b/scripts/start-docker.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+# Container startup: run the one-shot DB check/migration and tracker update, then
+# exec the long-running server so it replaces this shell as PID 1.
+#
+# This avoids `npm-run-all` keeping idle `npm`/`npm-run-all` parent processes
+# resident for the lifetime of the container (each a full Node VM holding tens
+# of MiB of anonymous memory). `exec` leaves a single `node server.js` process.
+#
+# PATH is extended so check-db.js's `prisma migrate deploy` resolves the prisma
+# CLI from node_modules/.bin the way `npm run` would have injected it.
+set -e
+export PATH="$PWD/node_modules/.bin:$PATH"
+
+node scripts/check-db.js
+node scripts/update-tracker.js
+exec node server.js