diff --git a/data-access/servlet/src/main/resources/cutout.properties b/data-access/servlet/src/main/resources/cutout.properties
index 67c91761ef42083cd900eb4d60f5e532e9db69f8..ad6722dd92a63a2641b732cecb0888a17d1968bf 100644
--- a/data-access/servlet/src/main/resources/cutout.properties
+++ b/data-access/servlet/src/main/resources/cutout.properties
@@ -8,7 +8,7 @@
 
 ## MIME-type of the response
 
-# [1]:
+# [1] (default):
 
 # default_response_format=application/fits
 
diff --git a/docker/Dockerfile b/docker/Dockerfile
index e970b10e0e224dff55c51d50ea364f4a03ae0026..e3c3652da9e72ddd0d2c266c1beb9a5172ff0fb7 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -12,23 +12,29 @@ RUN apt -y update \
                    rabbitmq-server openjdk-17-jre openjdk-17-jdk tomcat9 tomcat9-admin \
                    postgresql-client
 
+ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
+ENV CATALINA_BASE=/var/lib/tomcat9
+ENV CATALINA_HOME=/usr/share/tomcat9
+ENV CATALINA_TMPDIR=/tmp
+
+ENV WEBAPP_DIR=/webapps/vlkb-cutout
+
 COPY ast_9.2.9-1_amd64.deb ./
 RUN dpkg -i /root/ast_9.2.9-1_amd64.deb && ldconfig \
- && mkdir -p /webapps/vlkb-cutout && mkdir /config \
+ && mkdir -p ${WEBAPP_DIR} \
  && mkdir -p /srv/surveys && mkdir -p /srv/cutouts
 
+
 ARG VLKB_VERSION
 
 COPY vlkb-${VLKB_VERSION}.deb vlkb-obscore-${VLKB_VERSION}.deb vlkbd-${VLKB_VERSION}.deb ./
-COPY vlkb-cutout-${VLKB_VERSION}.war /webapps/vlkb-cutout/
+COPY vlkb-cutout-${VLKB_VERSION}.war ${WEBAPP_DIR}/
 RUN dpkg -i vlkb-${VLKB_VERSION}.deb vlkb-obscore-${VLKB_VERSION}.deb vlkbd-${VLKB_VERSION}.deb \
- && cd /webapps/vlkb-cutout && jar -xf vlkb-cutout-${VLKB_VERSION}.war
+ && cd ${WEBAPP_DIR} && jar -xf vlkb-cutout-${VLKB_VERSION}.war
  
+# Tomcat must load DB-driver (postgresql_*.jar), vlkb-cutout does not explicitely load DB-drivers
 COPY postgresql-*.jar  /var/lib/tomcat9/lib
 
-# Lines with postgresql_*.jar: provide DB-driver so Tomcat loads it
-# vlkb-cutout does not explicitely load DB-drivers
-
 
 
 # configure instance
@@ -47,9 +53,7 @@ RUN mkdir -p ${INST_DIR}/etc/vlkb-obscore \
 COPY config/vlkb-obscore.datasets.conf ${INST_DIR}/etc/vlkb-obscore/datasets.conf
 COPY config/vlkbd.datasets.conf ${INST_DIR}/etc/vlkbd/datasets.conf
 
-# created in entrypoint.sh COPY config/servlet.cutout.properties /webapps/vlkb-cutout/WEB-INF/classes/cutout.properties
-
-COPY config/auth.properties config/neatoken.properties config/iamtoken.properties /webapps/vlkb-cutout/WEB-INF/classes/
+COPY config/auth.properties config/neatoken.properties config/iamtoken.properties ${WEBAPP_DIR}/WEB-INF/classes/
 
 #COPY ssl/keystore.jks /root/
 COPY ssl/server.xml ssl/server-connector-8080.xml ssl/server-connector-8443.xml /etc/tomcat9/
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index bc1795fc141bd99e89ed49cb5364872705648694..85500956e5fa0786f010a80d281303b4da6f698c 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -7,28 +7,29 @@ LOG_FILE=/tmp/entrypoint.log
 date
 whoami
 env
+
 #########################################################################
-#INST_DIR="/usr/local"
-WEBAPP_DIR=/webapps
-#CONFIG_DIR=/config
-QUEUE_NAME=dockervlkb$ACCESS_CONTEXT_ROOT
-
-echo "SECURITY   : "$SECURITY
-echo "VLKBOBSCORE_PG_URI     : "$VLKBOBSCORE_PG_URI
-echo "ACCESS_CONTEXT_ROOT    : "$ACCESS_CONTEXT_ROOT
-echo "RESPONSE_FORMAT        : "$RESPONSE_FORMAT
-echo "URL_CUTOUTS            : "$URL_CUTOUTS
+echo "run-time config (compose.yaml):"
+echo "SECURITY            : "$SECURITY
+echo "AUTH_DB_*           : "$AUTH_DB_URI" ["$AUTH_DB_SCHEMA"] "$AUTH_DB_USERNAME" / "$AUTH_DB_PASSWORD
+
+echo "ACCESS_CONTEXT_ROOT : "$ACCESS_CONTEXT_ROOT
+echo "RESPONSE_FORMAT     : "$RESPONSE_FORMAT
+echo "URL_CUTOUTS         : "$URL_CUTOUTS
+echo "RESOLVER_DB_*       : "$RESOLVER_DB_URI" ["$RESOLVER_DB_SCHEMA"] "$RESOLVER_DB_USERNAME" / "$RESOLVER_DB_PASSWORD
+echo "VLKBOBSCORE_PG_URI  : "$VLKBOBSCORE_PG_URI
+
+echo "build-time config'd (Dockefile):"
 echo "INST_DIR   : "$INST_DIR
 echo "WEBAPP_DIR : "$WEBAPP_DIR
-#echo "CONFIG_DIR : "$CONFIG_DIR
-echo "QUEUE_NAME : "$QUEUE_NAME
-#########################################################################
-
 
+echo "JAVA_HOME       : "$JAVA_HOME
+echo "CATALINA_BASE   : "$CATALINA_BASE
+echo "CATALINA_HOME   : "$CATALINA_HOME
+echo "CATALINA_TMPDIR : "$CATALINA_TMPDIR
+#########################################################################
 
 ## configure vlkb-tools
-#mkdir -p $INST_DIR/etc/vlkb-obscore
-#cp $CONFIG_DIR/vlkb-obscore.datasets.conf $INST_DIR/etc/vlkb-obscore/datasets.conf
 if test -n "$VLKBOBSCORE_PG_URI"
 then
    echo "pg_uri=$VLKBOBSCORE_PG_URI" >> $INST_DIR/etc/vlkb-obscore/datasets.conf
@@ -37,59 +38,74 @@ fi
 
 
 ## configure VLKB access
-if test -n "$ACCESS_CONTEXT_ROOT"
-then
-
-   if test -n "$SECURITY"
-   then
-      cd $WEBAPP_DIR/vlkb-cutout/WEB-INF/ && rm -f web.xml && cp web-cutout-$SECURITY.xml web.xml && cd -
-   fi
-
-#   cp $CONFIG_DIR/{auth.properties,neatoken.properties} $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/
-   #echo "<Context docBase=\"$WEBAPP_DIR/vlkb-cutout\"/>" > /var/lib/tomcat9/conf/Catalina/localhost/$ACCESS_CONTEXT_ROOT.xml
-   cp $WEBAPP_DIR/vlkb-cutout/META-INF/context.xml /var/lib/tomcat9/conf/Catalina/localhost/$ACCESS_CONTEXT_ROOT.xml
-   echo "db_uri=$DISCOVERY_DB_URI"  >  $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/authpolicy.properties
-   echo "db_schema=datasets"        >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/authpolicy.properties
-   echo "db_user_name=$DB_USERNAME" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/authpolicy.properties
-   echo "db_password=$DB_PASSWORD"  >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/authpolicy.properties
 
+cp $WEBAPP_DIR/META-INF/context.xml $CATALINA_BASE/conf/Catalina/localhost/$ACCESS_CONTEXT_ROOT.xml
+
+echo "fits_path_surveys=/srv/surveys" > $WEBAPP_DIR/WEB-INF/classes/cutout.properties
+
+{ # write cutout.properties
+
+   case $RESPONSE_FORMAT in
+      application/fits)
+         ;;
+      "application/fits;createfile=yes")
+         echo "default_response_format=$RESPONSE_FORMAT"
+         echo "fits_path_cutouts=/srv/cutouts"
+         QUEUE_NAME=dockervlkb$ACCESS_CONTEXT_ROOT
+         ;;
+      application/x-vlkb*)
+         echo "default_response_format=$RESPONSE_FORMAT"
+         echo "fits_path_cutouts=/srv/cutouts"
+         echo "fits_url_cutouts=$URL_CUTOUTS"
+         echo "surveys_metadata_abs_pathname=/srv/surveys/survey_populate.csv"
+         QUEUE_NAME=dockervlkb$ACCESS_CONTEXT_ROOT
+         echo "default_sky_system=GALACTIC"
+         echo "default_spec_system=VELO_LSRK"
+         echo "show_duration=yes"
+         ;;
+   esac
 
-   echo "fits_path_surveys=/srv/surveys" > $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   echo "fits_path_cutouts=/srv/cutouts" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   if test -f /srv/surveys/survey_populate.csv
+   if test -n "$QUEUE_NAME"
    then
-      echo "surveys_metadata_abs_pathname=/srv/surveys/survey_populate.csv" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-      echo "fits_url_cutouts=$URL_CUTOUTS" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
+      echo "amqp_host_name=localhost"
+      echo "amqp_port=5672"
+      echo "amqp_routing_key=$QUEUE_NAME"
    fi
-   if test -n "$RESPONSE_FORMAT"
+
+   if test -n "$RESOLVER_DB_URI"
    then
-      echo "default_response_format=$RESPONSE_FORMAT" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
+      echo "db_uri=$RESOLVER_DB_URI"
+      echo "db_schema=$RESOLVER_DB_SCHEMA"
+      echo "db_user_name=$RESOLVER_DB_USERNAME"
+      echo "db_password=$RESOLVER_DB_PASSWORD"
    fi
 
-   case $RESPONSE_FORMAT in application/x-vlkb*)
-      echo "default_sky_system=GALACTIC"   >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-      echo "default_spec_system=VELO_LSRK" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-      echo "show_duration=yes"             >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   esac
+} >> $WEBAPP_DIR/WEB-INF/classes/cutout.properties
 
-   # for resolver (id & extraCards)
-   echo "db_uri=$DISCOVERY_DB_URI"  >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   echo "db_schema=datasets"        >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   echo "db_user_name=$DB_USERNAME" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   echo "db_password=$DB_PASSWORD"  >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
 
-   echo "amqp_host_name=localhost"     >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   echo "amqp_port=5672"               >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-   echo "amqp_routing_key=$QUEUE_NAME" >> $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/cutout.properties
-
-   case $RESPONSE_FORMAT in application/x-vlkb*)
-      service rabbitmq-server start
-      $INST_DIR/bin/vlkbd_exec.sh localhost $QUEUE_NAME $INST_DIR/etc/vlkbd/datasets.conf
-   esac
+if test -n "$QUEUE_NAME"
+then
+   service rabbitmq-server start
+   $INST_DIR/bin/vlkbd_exec.sh localhost $QUEUE_NAME $INST_DIR/etc/vlkbd/datasets.conf
 fi
 
 
 
+if test -n "$SECURITY"
+then
+   cd $WEBAPP_DIR/WEB-INF/ && rm -f web.xml && cp web-cutout-$SECURITY.xml web.xml && cd -
+   echo "db_uri=$AUTH_DB_URI"            >  $WEBAPP_DIR/WEB-INF/classes/authpolicy.properties
+   echo "db_schema=$AUTH_DB_SCHEMA"      >> $WEBAPP_DIR/WEB-INF/classes/authpolicy.properties
+   echo "db_user_name=$AUTH_DB_USERNAME" >> $WEBAPP_DIR/WEB-INF/classes/authpolicy.properties
+   echo "db_password=$AUTH_DB_PASSWORD"  >> $WEBAPP_DIR/WEB-INF/classes/authpolicy.properties
+fi
+
+# configure access-token validation
+if test -f /srv/surveys/iamtoken.properties
+then
+   cp /srv/surveys/iamtoken.properties $WEBAPP_DIR/WEB-INF/classes/
+fi
+
 # configure port/SSL connector: (path is relative to the dir where compose.yaml is
 # - web.xml to run filters set above
 # * ssl: set tomcat connector with certificates (ia2 needs SECTIGO, iam needs self-signed keystore.jks)
@@ -113,9 +129,7 @@ case $SECURITY in
       echo "Security not configured, runs open."
       ;;
 esac
-
-
-
+#
 #if test -f /srv/surveys/keystore.jks
 #then
 #   cp /srv/surveys/keystore.jks /root/
@@ -132,12 +146,6 @@ else
    cd /etc/tomcat9/ && ln -s server-connector-8080.xml server-connector.xml && cd -
 fi
 
-# configure access-token validation
-if test -f /srv/surveys/iamtoken.properties
-then
-   cp /srv/surveys/iamtoken.properties $WEBAPP_DIR/vlkb-cutout/WEB-INF/classes/
-fi
-
 
 #########################################################################
 
@@ -145,7 +153,7 @@ date
 
 } 1> $LOG_FILE 2>&1
 
-JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64 CATALINA_BASE=/var/lib/tomcat9 CATALINA_HOME=/usr/share/tomcat9 CATALINA_TMPDIR=/tmp /usr/libexec/tomcat9/tomcat-start.sh &
+/usr/libexec/tomcat9/tomcat-start.sh &
 
 wait -n