diff --git a/CreateMatrix/Dockerfile.cs b/CreateMatrix/Dockerfile.cs
index 98cccd05..2035c556 100644
--- a/CreateMatrix/Dockerfile.cs
+++ b/CreateMatrix/Dockerfile.cs
@@ -304,6 +304,10 @@ RUN apt-get update \
                     && chown --verbose ${COMPANY_NAME}:${COMPANY_NAME} /opt/${COMPANY_NAME}/mediaserver/bin/external.dat
 
                 """;
+            // Note: for LSIO, currentOsVariantOverride=docker is injected at runtime by
+            // s6-overlay/s6-rc.d/init-nx-relocate/run, because LSIO replaces
+            // /opt/${COMPANY_NAME}/mediaserver/etc with a symlink to /config/etc on first
+            // start, which would erase any build-time edit to the directory.
         }
         else
         {
@@ -312,6 +316,10 @@ RUN apt-get update \
                 # Only allow sudo no password access to the root-tool
                 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
+                # Tell mediaserver it is running under Docker so it reports its OS variant correctly
+                # https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+                RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
+
                 """;
         }
 
diff --git a/Docker/DWSpectrum.Dockerfile b/Docker/DWSpectrum.Dockerfile
index 52d66c8e..a3b72c17 100644
--- a/Docker/DWSpectrum.Dockerfile
+++ b/Docker/DWSpectrum.Dockerfile
@@ -101,6 +101,10 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
+# Tell mediaserver it is running under Docker so it reports its OS variant correctly
+# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
+
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/NxGo.Dockerfile b/Docker/NxGo.Dockerfile
index c77be6a1..e637fb49 100644
--- a/Docker/NxGo.Dockerfile
+++ b/Docker/NxGo.Dockerfile
@@ -101,6 +101,10 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
+# Tell mediaserver it is running under Docker so it reports its OS variant correctly
+# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
+
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/NxMeta.Dockerfile b/Docker/NxMeta.Dockerfile
index d827fa6c..b52ae321 100644
--- a/Docker/NxMeta.Dockerfile
+++ b/Docker/NxMeta.Dockerfile
@@ -101,6 +101,10 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
+# Tell mediaserver it is running under Docker so it reports its OS variant correctly
+# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
+
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/NxWitness.Dockerfile b/Docker/NxWitness.Dockerfile
index f46374bc..deba664d 100644
--- a/Docker/NxWitness.Dockerfile
+++ b/Docker/NxWitness.Dockerfile
@@ -101,6 +101,10 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
+# Tell mediaserver it is running under Docker so it reports its OS variant correctly
+# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
+
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/WisenetWAVE.Dockerfile b/Docker/WisenetWAVE.Dockerfile
index 5c6c7bbb..ce2006d9 100644
--- a/Docker/WisenetWAVE.Dockerfile
+++ b/Docker/WisenetWAVE.Dockerfile
@@ -101,6 +101,10 @@ RUN apt-get update \
 # Only allow sudo no password access to the root-tool
 RUN echo "${COMPANY_NAME} ALL = NOPASSWD: /opt/${COMPANY_NAME}/mediaserver/bin/root-tool" > /etc/sudoers.d/${COMPANY_NAME}
 
+# Tell mediaserver it is running under Docker so it reports its OS variant correctly
+# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+RUN echo "currentOsVariantOverride=docker" >> /opt/${COMPANY_NAME}/mediaserver/etc/mediaserver.conf
+
 # Copy the entrypoint.sh launch script
 # entrypoint.sh will run the mediaserver and root-tool
 COPY entrypoint.sh /opt/entrypoint.sh
diff --git a/Docker/s6-overlay/s6-rc.d/init-nx-relocate/run b/Docker/s6-overlay/s6-rc.d/init-nx-relocate/run
index 09398749..3eb0ee6b 100755
--- a/Docker/s6-overlay/s6-rc.d/init-nx-relocate/run
+++ b/Docker/s6-overlay/s6-rc.d/init-nx-relocate/run
@@ -68,3 +68,15 @@ then
     echo "../mediaserver/var/data exists, deleting"
     rm /opt/${COMPANY_NAME}/mediaserver/var/data
 fi
+
+# Tell mediaserver it is running under Docker so it reports its OS variant correctly
+# https://github.com/networkoptix/nxvms-docker/commit/54bbd16
+# Inject at runtime rather than build time because the etc directory above is replaced
+# by a symlink to /config/etc on first start, which would erase any build-time edit.
+MEDIASERVER_CONF="/config/etc/mediaserver.conf"
+if ! grep -q "^currentOsVariantOverride=docker" "${MEDIASERVER_CONF}" 2>/dev/null
+then
+    echo "Adding currentOsVariantOverride=docker to ${MEDIASERVER_CONF}"
+    echo "currentOsVariantOverride=docker" >> "${MEDIASERVER_CONF}"
+    chown ${COMPANY_NAME}:${COMPANY_NAME} "${MEDIASERVER_CONF}"
+fi
diff --git a/README.md b/README.md
index 13e9ddbb..1362c43e 100644
--- a/README.md
+++ b/README.md
@@ -52,6 +52,9 @@ services:
       - test_nxwitness-lsio_media:/media
       - test_nxwitness-lsio_backup:/backup
       - test_nxwitness-lsio_analytics:/analytics
+    tmpfs:
+      # Keep mediaserver's unix socket and tmp files in RAM
+      - /tmp:size=1g,mode=1777
 ```
 
 ```shell
@@ -93,15 +96,19 @@ services:
     security_opt: # Set with care
       - seccomp=unconfined
       - apparmor=unconfined
+    devices: # Pass through Intel/AMD iGPU for hardware accelerated video
+      - /dev/dri
     environment:
       - TZ=${TZ}
       - PUID=${USER_NONROOT_ID} # Run as non-root user
       - PGID=${USERS_GROUP_ID}
     volumes: # ZFS volumes
       - ${APPDATA_DIR}/nxmeta/config:/config
-      - ${NVR_DIR}/media:/media
-      - ${NVR_DIR}/backup:/backup
-      - ${NVR_DIR}/analytics:/analytics
+      - ${NVR_DIR}/media:/media # ssdpool/nvr-media
+      - ${NVR_DIR}/backup:/backup # hddpool/nvr-backup
+      - ${NVR_DIR}/analytics:/analytics # ssdpool/nvr-analytics
+    tmpfs: # Keep mediaserver's unix socket and tmp files in RAM
+      - /tmp:size=1g,mode=1777
     networks:
       public_network:
         ipv4_address: ${NXMETA_IP} # Static IP
@@ -110,7 +117,7 @@ services:
       stack_network:
     labels:
       - traefik.enable=true # Traefik SSL proxy
-      - traefik.http.routers.nxmeta.rule=HostRegexp(`^nxmeta${DOMAIN_REGEX}$$`)
+      - traefik.http.routers.nxmeta.rule=HostRegexp(`^nxmeta-web${DOMAIN_REGEX}$$`)
       - traefik.http.services.nxmeta.loadbalancer.server.scheme=https
       - traefik.http.services.nxmeta.loadbalancer.server.port=7001
 ```
@@ -361,6 +368,9 @@ services:
     volumes:
       - /mnt/nxwitness/config:/config
       - /mnt/nxwitness/media:/media
+    tmpfs:
+      # Keep mediaserver's unix socket and tmp files in RAM
+      - /tmp:size=1g,mode=1777
 ```
 
 ### Non-LSIO Docker Compose
@@ -377,6 +387,9 @@ services:
       - /mnt/nxwitness/config/nx_ini:/home/networkoptix/.config/nx_ini
       - /mnt/nxwitness/config/var:/opt/networkoptix/mediaserver/var
       - /mnt/nxwitness/media:/media
+    tmpfs:
+      # Keep mediaserver's unix socket and tmp files in RAM
+      - /tmp:size=1g,mode=1777
 ```
 
 ### Unraid Template
@@ -450,6 +463,7 @@ services:
   - Camera recording license keys are activated and bound to hardware attributes of the host server collected by the `root-tool` that is required to run as `root`.
   - Requiring the `root-tool` to run as root overly complicates running the `mediaserver` as a non-root user, and requires the container to run using `host` networking to not break the hardware license checks.
   - Docker containers are supposed to be portable, and moving containers between hosts will break license activation.
+  - Nx's own [`nxvms-docker`][nxgithubcompose-link] reference image [recently disabled `root-tool`](https://github.com/networkoptix/nxvms-docker/commit/4285f93) by setting `ignoreRootTool=true` in `mediaserver.conf` and dropping their separate `root-tool` container. This trades hardware-ID license enforcement for a simpler unprivileged container. NxWitness does **not** follow this change — licensed deployments would lose activation — and will revisit only if Nx publishes a clearer official position on Docker licensing without `root-tool`.
   - Nx to fix: Associate licenses with the [Cloud Account][nxcloud-link] not the local hardware.
 - Storage Management:
   - The mediaserver attempts to automatically decide what storage to use.