diff --git a/docker/docker-compose.quickstart.yml b/docker/docker-compose.quickstart.yml
index 65705059aa..16fa17bccc 100644
--- a/docker/docker-compose.quickstart.yml
+++ b/docker/docker-compose.quickstart.yml
@@ -1,3 +1,11 @@
+# Quickstart: single-container Paperclip with embedded database.
+# Copy this file and set the required env vars before running.
+#
+#   cd docker
+#   export BETTER_AUTH_SECRET="$(openssl rand -hex 32)"
+#   export ANTHROPIC_API_KEY="sk-ant-..."
+#   docker compose -f docker-compose.quickstart.yml up --build
+#
 services:
   paperclip:
     build:
@@ -8,11 +16,21 @@ services:
     environment:
       HOST: "0.0.0.0"
       PAPERCLIP_HOME: "/paperclip"
+
+      # ── LLM provider keys (at least one is needed for agents to work) ──
       OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
       ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY:-}"
+
+      # ── Deployment settings ──
+      # "authenticated" requires login, "local_trusted" skips auth
       PAPERCLIP_DEPLOYMENT_MODE: "authenticated"
+      # "private" = LAN only, "public" = internet-facing (use with TLS)
       PAPERCLIP_DEPLOYMENT_EXPOSURE: "private"
+      # Base URL users will access the UI at
       PAPERCLIP_PUBLIC_URL: "${PAPERCLIP_PUBLIC_URL:-http://localhost:3100}"
+
+      # ── Required secret for session signing (generate with: openssl rand -hex 32) ──
       BETTER_AUTH_SECRET: "${BETTER_AUTH_SECRET:?BETTER_AUTH_SECRET must be set}"
     volumes:
+      # Persistent data directory (database, agent workspaces, uploads)
       - "${PAPERCLIP_DATA_DIR:-../data/docker-paperclip}:/paperclip"