diff --git a/Dockerfile b/Dockerfile
index 6857a25..7f2ca9a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,15 @@
-FROM ubuntu:18.04
+FROM ubuntu:22.04
 
 LABEL maintainer="Tomohisa Kusano <siomiz@gmail.com>"
 
-ENV VNC_SCREEN_SIZE 1024x768
+ENV VNC_SCREEN_SIZE=1024x768
 
 COPY copyables /
 
 RUN apt-get update \
-	&& apt-get install -y --no-install-recommends \
+	&& DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
+	&& DEBIAN_FRONTEND=noninteractive \
+	apt-get install -y --no-install-recommends \
 	gnupg2 \
 	fonts-noto-cjk \
 	pulseaudio \
@@ -24,7 +26,7 @@ ADD https://dl.google.com/linux/linux_signing_key.pub \
 RUN apt-key add /tmp/linux_signing_key.pub \
 	&& dpkg -i /tmp/google-chrome-stable_current_amd64.deb \
 	|| dpkg -i /tmp/chrome-remote-desktop_current_amd64.deb \
-	|| apt-get -f --yes install
+	|| DEBIAN_FRONTEND=noninteractive apt-get -f --yes install
 
 RUN apt-get clean \
 	&& rm -rf /var/cache/* /var/log/apt/* /var/lib/apt/lists/* /tmp/* \
@@ -43,8 +45,12 @@ RUN apt-get clean \
 	' >> /home/chrome/.fluxbox/init \
 	&& chown -R chrome:chrome /home/chrome/.config /home/chrome/.fluxbox
 
+USER chrome
+
 VOLUME ["/home/chrome"]
 
+WORKDIR /home/chrome
+
 EXPOSE 5900
 
 ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]
diff --git a/README.md b/README.md
index 4eba4bc..feb6694 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,10 @@
+_:new: Recent update made `chrome` the running USER. Chrome profile must be owned by user `chrome` so you may need to run `docker exec --volumes-from <your-chrome-profile> --user root siomiz/chrome chown -R chrome:chrome /home/chrome` to fix permission issues._
+
 Google Chrome via VNC
 ==
 `docker run -p 127.0.0.1:5900:5900 siomiz/chrome`
 
- - Google Chrome, not Chromium, for the ease of Flash plugin management
+ - Google Chrome, ~~not Chromium, for the ease of Flash plugin management~~
  - on Xvfb, with FluxBox (no window decorations)
  - served by X11VNC (no password; assuming usage via SSH)
 
@@ -29,7 +31,7 @@ Usage
 
 Chrome Updates
 --
-It is recommended to `docker pull siomiz/chrome` and restart the container once in a while to update chrome & crd inside (they will not get automatically updated). Optionally you can run `docker exec <chrome-container> update` to upgrade only google-chrome-stable from outside the container (exit Chrome inside CRD after upgrading).
+It is recommended to `docker pull siomiz/chrome` and restart the container once in a while to update chrome & crd inside (they will not get automatically updated). Optionally you can run `docker exec --user=root <chrome-container> update` to upgrade only google-chrome-stable from outside the container (exit Chrome inside CRD after upgrading).
 
   [1]: https://www.google.com/intl/en/chrome/browser/privacy/eula_text.html
   [2]: https://code.google.com/p/chromium/issues/detail?id=490964
diff --git a/copyables/etc/supervisor/conf.d/supervisord.conf b/copyables/etc/supervisor/conf.d/supervisord.conf
index 9e7d39f..ccaadef 100644
--- a/copyables/etc/supervisor/conf.d/supervisord.conf
+++ b/copyables/etc/supervisor/conf.d/supervisord.conf
@@ -3,6 +3,7 @@ nodaemon=true
 
 [program:xvfb]
 command=/usr/bin/Xvfb :1 -screen 0 %(ENV_VNC_SCREEN)s +extension RANDR
+user=chrome
 autorestart=true
 priority=100
 
diff --git a/copyables/update b/copyables/update
index 0a4bf38..bc5554d 100755
--- a/copyables/update
+++ b/copyables/update
@@ -1,5 +1,10 @@
 #!/bin/bash
-set -e
+# set -e
+
+if [ "$EUID" -ne 0 ]; then
+	echo '"update" needs root; use `--user=root` on `docker exec`'
+	exit -1
+fi
 
 apt-get update -qq \
 	-o Dir::Etc::sourcelist="sources.list.d/google-chrome.list" \
@@ -8,11 +13,13 @@ apt-get update -qq \
 
 for pkg in "google-chrome-stable"; do
 
-        IFS=": " read -r p i iv c cv x <<< $(apt-cache policy $pkg)
+	read -r -d '' _ iv _ cv _ <<< $(apt-cache policy $pkg | awk '{ print $2 }')
 
-        if [ "$iv" != "$cv" ]; then
-                apt-get install --only-upgrade -y -qq $pkg
-                echo $pkg upgraded to $cv
-        fi
+	if [ "$iv" != "$cv" ]; then
+		apt-get install --only-upgrade -y -qq $pkg
+		echo $pkg upgraded to $cv
+	else
+		echo $pkg $iv is latest
+	fi
 
 done