diff --git a/Dockerfile b/Dockerfile
index 0508f68..67777a0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -33,6 +33,16 @@ FROM base
 COPY --from=build /opt/venv /opt/venv
 ENV PATH="/opt/venv/bin:$PATH"
 
+# install Firefox
+RUN dnf install -y wget bzip2 xorg-x11-server-Xvfb gtk3 dbus-glib
+RUN wget -qO- "https://download.mozilla.org/?product=firefox-latest-ssl&os=linux64&lang=en-US" | tar -C /usr/local/ -jx && \
+    ln -s /usr/local/firefox/firefox /usr/bin/firefox && \
+    echo "exclude=firefox" >> /etc/dnf/dnf.conf
+
+# install geckodriver
+RUN url=$( curl -s https://api.github.com/repos/mozilla/geckodriver/releases/latest | grep -Eoh 'https.*linux64\.tar\.gz' ) && \
+    curl -sL "$url" | tar -C /usr/bin/ -xz
+
 # install the application
 WORKDIR /app
 COPY vasl_templates vasl_templates
diff --git a/docker/config/site.cfg b/docker/config/site.cfg
index c72edbe..09d9ddc 100644
--- a/docker/config/site.cfg
+++ b/docker/config/site.cfg
@@ -2,3 +2,5 @@
 
 FLASK_HOST = 0.0.0.0
 IS_CONTAINER = 1
+
+WEBDRIVER_PATH = /usr/bin/geckodriver
diff --git a/docker/run.sh b/docker/run.sh
index 81e55ff..4fa525b 100755
--- a/docker/run.sh
+++ b/docker/run.sh
@@ -1,3 +1,8 @@
 #!/bin/sh
 
+# set up the display (so we can run a webdriver)
+export ENV=10
+Xvfb :10 -ac 1>/tmp/xvfb.log 2>/tmp/xvfb.err &
+
+# run the webapp server
 python /app/vasl_templates/webapp/run_server.py
diff --git a/run-container.sh b/run-container.sh
index eb56ff2..b5fbe02 100755
--- a/run-container.sh
+++ b/run-container.sh
@@ -18,6 +18,17 @@ function print_help {
     echo "        --no-build         Launch the container as-is (i.e. without rebuilding it first)."
     echo "        --build-network    Docker network to use when building the container."
     echo "        --run-network      Docker network to use when running the container."
+    echo
+    cat <<EOM
+  NOTE: If the port the webapp server is listening on *inside* the container is different
+  to the port exposed *outside* the container, webdriver image generation (e.g. Shift-Click
+  on a snippet button, or Chapter H content as images) may not work properly. This is because
+  a web browser is launched internally with snippet HTML and a screenshot taken of it, but
+  the HTML will contain links to the webapp server that work from outside the container,
+  but if those links don't resolve from inside the container, you will get broken images.
+  In this case, you will need to make such links resolve from inside the container e.g. by
+  port-forwarding, or via DNS.
+EOM
 }
 
 # ---------------------------------------------------------------------