diff --git a/README.md b/README.md
index a4b15ca..6b2b05a 100644
--- a/README.md
+++ b/README.md
@@ -16,7 +16,16 @@
 
 ## Table of contents:
 
-TODO
+- [What it does](#what-it-does)
+- [Features](#features)
+- [Screenshots](#screenshots)
+- [Installation](#installation)
+  - [Unraid](#unraid)
+  - [Docker](#docker)
+- [Authentication](#authentication)
+- [EFF donations](#eff-donations)
+- [Pre-release disclaimer](#pre-release-disclaimer)
+- [Development](#development)
 
 ## What it does
 
@@ -68,6 +77,8 @@ docker run \
   keglin/pinchflat:latest
 ```
 
+NOTE: it's recommended to not run the container as root. Doing so can create permission issues if other apps need to work with the downloaded media. If you need to run any command as root, you can run `su` from the container's shell as there is no password set for the root user.
+
 ## Authentication
 
 HTTP basic authentication is optionally supported. To use it, set the `BASIC_AUTH_USERNAME` and `BASIC_AUTH_PASSWORD` environment variables when starting the container. No authentication will be required unless you set _both_ of these.