diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..4ba514d
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,7 @@
+# TODO
+
+## Infrastructure
+
+- [ ] **Rootless containers** — run backend and frontend containers as non-root users (add `USER` directive to Dockerfiles, map UID/GID appropriately)
+- [ ] **Persistent storage** — ensure database data, config files, and any uploaded assets survive container restarts and rebuilds (named volumes, bind mounts for config)
+- [ ] **Docker development workflow** — document and streamline the full dev loop: hot reload, one-command startup, migration handling, seed data, and how to attach a debugger