diff --git a/jetty/README.md b/jetty/README.md
index 52967a3d..4a311f99 100644
--- a/jetty/README.md
+++ b/jetty/README.md
@@ -28,13 +28,22 @@ You can then go to `http://localhost:8888` or `http://host-ip:8888` in a browser
 The default Jetty environment in the image is:
 
 	JETTY_HOME    =  /usr/local/jetty
+	JETTY_BASE    =  /var/lib/jetty
 	JETTY_CONF    =  /usr/local/jetty/etc/jetty.conf
-	JETTY_STATE   =  /usr/local/jetty/jetty.state
+	JETTY_STATE   =  /var/lib/jetty/jetty.state
 	JETTY_ARGS    =
 	JAVA_OPTIONS  =
 	TMPDIR        =  /tmp
 
-Webapps can be [deployed](https://wiki.eclipse.org/Jetty/Howto/Deploy_Web_Applications) in `/usr/local/jetty/webapps`.
+Webapps can be [deployed](https://wiki.eclipse.org/Jetty/Howto/Deploy_Web_Applications) in `/var/lib/jetty/webapps`.
+
+# Security
+
+By default, this image starts as user `root` and uses Jetty's `setuid` module to drop privileges to user `jetty` after initialization. The `JETTY_BASE` directory at `/var/lib/jetty` is owned by `jetty:jetty` (uid 999, gid 999).
+
+If you would like the image to start immediately as user `jetty` instead of starting as `root`, you can start the container with `-u jetty`:
+
+	docker run -d -u jetty jetty:9
 
 # License
 
diff --git a/jetty/content.md b/jetty/content.md
index 7543c2ea..88d0f4fe 100644
--- a/jetty/content.md
+++ b/jetty/content.md
@@ -21,10 +21,19 @@ You can then go to `http://localhost:8888` or `http://host-ip:8888` in a browser
 The default Jetty environment in the image is:
 
 	JETTY_HOME    =  /usr/local/jetty
+	JETTY_BASE    =  /var/lib/jetty
 	JETTY_CONF    =  /usr/local/jetty/etc/jetty.conf
-	JETTY_STATE   =  /usr/local/jetty/jetty.state
+	JETTY_STATE   =  /var/lib/jetty/jetty.state
 	JETTY_ARGS    =
 	JAVA_OPTIONS  =
 	TMPDIR        =  /tmp
 
-Webapps can be [deployed](https://wiki.eclipse.org/Jetty/Howto/Deploy_Web_Applications) in `/usr/local/jetty/webapps`.
+Webapps can be [deployed](https://wiki.eclipse.org/Jetty/Howto/Deploy_Web_Applications) in `/var/lib/jetty/webapps`.
+
+# Security
+
+By default, this image starts as user `root` and uses Jetty's `setuid` module to drop privileges to user `jetty` after initialization. The `JETTY_BASE` directory at `/var/lib/jetty` is owned by `jetty:jetty` (uid 999, gid 999).
+
+If you would like the image to start immediately as user `jetty` instead of starting as `root`, you can start the container with `-u jetty`:
+
+	docker run -d -u jetty jetty:9