diff --git a/.gitignore b/.gitignore
index 496ee2c..60570de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
-.DS_Store
\ No newline at end of file
+.DS_Store
+
+# Download file is generated at container startup via entrypoint.sh
+files/www/downloading
diff --git a/Dockerfile b/Dockerfile
index e4e3bbf..78d91e4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 # Dockerfile for https://hub.docker.com/r/openspeedtest/latest
 FROM nginxinc/nginx-unprivileged:stable-alpine
 
-LABEL maintainer "OpenSpeedTest.com <support@OpenSpeedTest.com>"
+LABEL maintainer="OpenSpeedTest.com <support@OpenSpeedTest.com>"
 
 ENV ENABLE_LETSENCRYPT=false
 ENV DOMAIN_NAME=false
@@ -15,6 +15,10 @@ ENV HTTP_PORT=3000
 ENV HTTPS_PORT=3001
 ENV SET_USER=101
 
+ARG FILE_SIZE=31457280
+ENV FILE_SIZE=${FILE_SIZE}
+ARG WITHOUT_LETSENCRYPT=false
+
 COPY /files/OpenSpeedTest-Server.conf ${CONFIG}
 COPY /files/entrypoint.sh /entrypoint.sh
 COPY /files/renew.sh /renew.sh
@@ -28,15 +32,16 @@ COPY /files/nginx.key /etc/ssl/
 
 USER root
 VOLUME /var/log/letsencrypt
+
+
 RUN rm -rf /etc/nginx/conf.d/default.conf \
-	&& chown -R nginx /usr/share/nginx/html/ \
-	&& chmod 755 /usr/share/nginx/html/downloading \
-	&& chmod 755 /usr/share/nginx/html/upload \
-	&& chown nginx ${CONFIG} \
-	&& chmod 400 ${CONFIG} \
-	&& chown nginx /etc/nginx/nginx.conf \
-	&& chmod 400 /etc/nginx/nginx.conf \
-	&& chmod +x /entrypoint.sh \
+    && chown -R nginx /usr/share/nginx/html/ \
+    && chmod 744 /usr/share/nginx/html/upload \
+    && chown nginx ${CONFIG} \
+    && chmod 400 ${CONFIG} \
+    && chown nginx /etc/nginx/nginx.conf \
+    && chmod 400 /etc/nginx/nginx.conf \
+    && chmod +x /entrypoint.sh \
 	&& chmod +x /renew.sh
 
 
@@ -56,17 +61,17 @@ RUN mkdir -p /var/log/letsencrypt && \
 RUN mkdir -p /usr/share/nginx/html/.well-known/acme-challenge && \
     chown -R nginx /usr/share/nginx/html/.well-known/acme-challenge && \
     chmod 775 /usr/share/nginx/html/.well-known/acme-challenge
- 
+
 RUN apk update && apk add ca-certificates && rm -rf /var/cache/apk/* 
 RUN update-ca-certificates
-RUN apk add --no-cache certbot certbot-nginx
-RUN apk update && apk add --no-cache dcron libcap
-
-RUN chown nginx:nginx /usr/sbin/crond \
-    && setcap cap_setgid=ep /usr/sbin/crond
-
-RUN touch /etc/crontabs/nginx
-RUN chown -R nginx:nginx /etc/crontabs/nginx
+RUN if [ "${WITHOUT_LETSENCRYPT}" != "true" ]; then \
+        apk add --no-cache certbot certbot-nginx && \
+        apk update && apk add --no-cache dcron libcap && \
+        chown nginx:nginx /usr/sbin/crond && \
+        setcap cap_setgid=ep /usr/sbin/crond && \
+        touch /etc/crontabs/nginx && \
+        chown -R nginx:nginx /etc/crontabs/nginx; \
+    fi
 
 USER ${SET_USER}
 
@@ -74,4 +79,4 @@ EXPOSE ${HTTP_PORT} ${HTTPS_PORT}
 
 STOPSIGNAL SIGQUIT
 
-CMD ["/entrypoint.sh"]
\ No newline at end of file
+CMD ["/entrypoint.sh"]
diff --git a/files/entrypoint.sh b/files/entrypoint.sh
index 6c5abdb..86053c1 100644
--- a/files/entrypoint.sh
+++ b/files/entrypoint.sh
@@ -1,5 +1,15 @@
 #!/bin/sh
 
+DL_FILE="/usr/share/nginx/html/downloading"
+DL_SIZE="${FILE_SIZE:-31457280}"
+if [ "$(stat -c%s "$DL_FILE" 2>/dev/null || echo 0)" != "$DL_SIZE" ]; then
+  if head -c "$DL_SIZE" /dev/urandom > "$DL_FILE" 2>/dev/null; then
+    echo "Generated $DL_SIZE bytes of random test data at $DL_FILE"
+  else
+    echo "Warning: could not generate $DL_FILE (read-only mount?); serving without it."
+  fi
+fi
+
 ip a | egrep -q 'inet6 '
 if [[ $? -ne 0 ]]; then
   # IPv6 not enabled
@@ -121,6 +131,15 @@ if [ "$DOMAIN_NAME" ]; then
 sed -i "/\bYOURDOMAIN\b/c\ server_name _ localhost ${DOMAIN_NAME};" "${CONFIG}"
 fi
 
+# Check if Let's Encrypt is requested but certbot not installed (early check)
+if [ "$ENABLE_LETSENCRYPT" = True ] && [ "$DOMAIN_NAME" ] && [ "$USER_EMAIL" ]; then
+  if ! command -v certbot >/dev/null 2>&1; then
+    echo "Error: Let's Encrypt requested but certbot not installed."
+    echo "Rebuild image with certbot support (default), or use image tagged with certbot."
+    exit 1
+  fi
+fi
+
 nginx -g 'daemon off;' & sleep 5
 
 if [ "$ENABLE_LETSENCRYPT" = True ] && [ "$DOMAIN_NAME" ] && [ "$USER_EMAIL" ]; then
@@ -147,6 +166,8 @@ certbot certonly -n --webroot --webroot-path /usr/share/nginx/html --no-redirect
   fi
 fi
 
-crond -b -l 5
+if command -v crond >/dev/null 2>&1; then
+    crond -f -l 5 &
+fi
 
-tail -f /dev/null
\ No newline at end of file
+tail -f /dev/null
diff --git a/files/renew.sh b/files/renew.sh
index be4b095..9aa3d31 100644
--- a/files/renew.sh
+++ b/files/renew.sh
@@ -5,6 +5,11 @@ fullchain_path="/var/log/letsencrypt/live/${DOMAIN_NAME}/fullchain.pem"
 
 if [ "$ENABLE_LETSENCRYPT" = True ] && [ "$DOMAIN_NAME" ] && [ "$USER_EMAIL" ]; then
 
+if ! command -v certbot >/dev/null 2>&1; then
+  echo "Error: certbot not installed. Skipping renewal."
+  exit 0
+fi
+
 certbot certonly -n --webroot --webroot-path /usr/share/nginx/html --no-redirect --agree-tos --email "$USER_EMAIL" -d "$DOMAIN_NAME" --config-dir /var/log/letsencrypt/ --work-dir /var/log/letsencrypt/work --logs-dir /var/log/letsencrypt/log
     if [ $? -eq 0 ]; then
         echo "certbot certonly -n... Executed."
diff --git a/files/www/downloading b/files/www/downloading
deleted file mode 100644
index b78c32f..0000000
Binary files a/files/www/downloading and /dev/null differ