diff --git a/Dockerfile b/Dockerfile
index f01a0d5..8baf048 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -35,7 +35,7 @@ ENV GEOSERVER_DATA_DIR=/opt/geoserver_data/
 ENV GEOSERVER_LIB_DIR=$CATALINA_HOME/webapps/geoserver/WEB-INF/lib/
 ENV GEOSERVER_REQUIRE_FILE=$GEOSERVER_DATA_DIR/global.xml
 ENV GEOSERVER_VERSION=$GS_VERSION
-ENV HEALTHCHECK_URL=http://localhost:8080/geoserver/web/wicket/resource/org.geoserver.web.GeoServerBasePage/img/logo.png
+ENV HEALTHCHECK_URL=''
 ENV INSTALL_EXTENSIONS=false
 ENV POSTGRES_JNDI_ENABLED=false
 ENV ROOT_WEBAPP_REDIRECT=false
@@ -43,6 +43,7 @@ ENV SKIP_DEMO_DATA=false
 ENV STABLE_EXTENSIONS=''
 ENV STABLE_PLUGIN_URL=$STABLE_PLUGIN_URL
 ENV WAR_ZIP_URL=$WAR_ZIP_URL
+ENV WEBAPP_CONTEXT=geoserver
 
 # see https://docs.geoserver.org/stable/en/user/production/container.html
 ENV CATALINA_OPTS="\$EXTRA_JAVA_OPTS \
@@ -122,4 +123,4 @@ WORKDIR /opt
 EXPOSE 8080
 
 HEALTHCHECK --interval=1m --timeout=20s --retries=3 \
-  CMD curl --fail $HEALTHCHECK_URL || exit 1
+  CMD curl --fail --url "$(cat $CATALINA_HOME/conf/healthcheck_url.txt)" || exit 1
diff --git a/README.md b/README.md
index 8e7fb14..ad70306 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,26 @@ docker run -it -p 80:8080 \
   docker.osgeo.org/geoserver:2.25.2
 ```
 
+## How to set the application context path?
+
+By default, GeoServer is served from <http://localhost/geoserver>. Use the environment variable `WEBAPP_CONTEXT` to change the context path.
+
+examples:
+
+The following will serve GeoServer from the root (<http://localhost/>):
+```shell
+docker run -it -p 80:8080 \
+  --env WEBAPP_CONTEXT="" \
+  docker.osgeo.org/geoserver:2.25.1
+```
+
+The following will serve GeoServer from <http://localhost/my_context_path>:
+```shell
+docker run -it -p 80:8080 \
+  --env WEBAPP_CONTEXT="my_context_path" \
+  docker.osgeo.org/geoserver:2.25.1
+```
+
 ## How to issue a redirect from the root ("/") to GeoServer web interface ("/geoserver/web")?
 
 By default, the ROOT webapp is not available which makes requests to the root endpoint "/" return a 404 error.
@@ -166,7 +186,7 @@ Example:
 ```shell
 docker run -it -p 80:8080 \
   --mount src="/path/to/my/server.xml",target=/opt/config_overrides/server.xml,type=bind \
-  docker.osgeo.org/geoserver:2.25.1
+  docker.osgeo.org/geoserver:2.25.2
 ```
 
 ## How to enable HTTPS?
diff --git a/config/context.xml b/config/context.xml
deleted file mode 100644
index 157fb73..0000000
--- a/config/context.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<Context antiResourceLocking="false" privileged="true" >
-    <Resource name="${POSTGRES_JNDI_RESOURCE_NAME}"
-              auth="Container"
-              type="javax.sql.DataSource"
-              driverClassName="org.postgresql.Driver"
-              url="jdbc:postgresql://${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}"
-              username="${POSTGRES_USERNAME}"
-              password="${POSTGRES_PASSWORD}"
-              maxTotal="25"
-              initialSize="0"
-              minIdle="0"
-              maxIdle="8"
-              maxWaitMillis="-1"
-              timeBetweenEvictionRunsMillis="30000"
-              minEvictableIdleTimeMillis="60000"
-              testWhileIdle="true"
-              validationQuery="SELECT 1"
-              rollbackOnReturn="true"
-    />
-</Context>
diff --git a/config/server-https.xml b/config/server-https.xml
index 23c84cf..3c2e40e 100644
--- a/config/server-https.xml
+++ b/config/server-https.xml
@@ -160,7 +160,7 @@
       </Realm>
 
       <Host name="localhost"  appBase="webapps"
-            unpackWARs="true" autoDeploy="true">
+            unpackWARs="true" autoDeploy="false" deployOnStartup="false">
 
         <!-- SingleSignOn valve, share authentication between web applications
              Documentation at: /docs/config/valve.html -->
@@ -174,7 +174,26 @@
         <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                prefix="localhost_access_log" suffix=".txt"
                pattern="%h %l %u %t &quot;%r&quot; %s %b" />
-
+          <Context antiResourceLocking="false" override="true" docBase="geoserver" privileged="true" path="${WEBAPP_CONTEXT}">
+               <Resource name="${POSTGRES_JNDI_RESOURCE_NAME}"
+                         auth="Container"
+                         type="javax.sql.DataSource"
+                         driverClassName="org.postgresql.Driver"
+                         url="jdbc:postgresql://${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}"
+                         username="${POSTGRES_USERNAME}"
+                         password="${POSTGRES_PASSWORD}"
+                         maxTotal="25"
+                         initialSize="0"
+                         minIdle="0"
+                         maxIdle="8"
+                         maxWaitMillis="-1"
+                         timeBetweenEvictionRunsMillis="30000"
+                         minEvictableIdleTimeMillis="60000"
+                         testWhileIdle="true"
+                         validationQuery="SELECT 1"
+                         rollbackOnReturn="true"
+               />
+          </Context>
       </Host>
     </Engine>
   </Service>
diff --git a/config/server.xml b/config/server.xml
index 5ade9f9..3c04e93 100644
--- a/config/server.xml
+++ b/config/server.xml
@@ -166,7 +166,7 @@
             </Realm>
 
             <Host name="localhost"  appBase="webapps"
-                  unpackWARs="true" autoDeploy="true">
+                  unpackWARs="true" autoDeploy="false" deployOnStartup="false">
 
                 <!-- SingleSignOn valve, share authentication between web applications
                      Documentation at: /docs/config/valve.html -->
@@ -181,6 +181,26 @@
                        prefix="localhost_access_log" suffix=".txt"
                        pattern="%h %l %u %t &quot;%r&quot; %s %b" />
 
+                <Context antiResourceLocking="false" override="true" docBase="geoserver" privileged="true" path="${WEBAPP_CONTEXT}">
+                    <Resource name="${POSTGRES_JNDI_RESOURCE_NAME}"
+                            auth="Container"
+                            type="javax.sql.DataSource"
+                            driverClassName="org.postgresql.Driver"
+                            url="jdbc:postgresql://${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}"
+                            username="${POSTGRES_USERNAME}"
+                            password="${POSTGRES_PASSWORD}"
+                            maxTotal="25"
+                            initialSize="0"
+                            minIdle="0"
+                            maxIdle="8"
+                            maxWaitMillis="-1"
+                            timeBetweenEvictionRunsMillis="30000"
+                            minEvictableIdleTimeMillis="60000"
+                            testWhileIdle="true"
+                            validationQuery="SELECT 1"
+                            rollbackOnReturn="true"
+                    />
+                </Context>
             </Host>
         </Engine>
     </Service>
diff --git a/startup.sh b/startup.sh
index 5eae9dd..35f4ddc 100755
--- a/startup.sh
+++ b/startup.sh
@@ -12,6 +12,12 @@ function copy_custom_config() {
     # Otherwise use the default
     echo "Installing default ${CONFIG_FILE} with substituted environment variables"
     envsubst < "${CONFIG_DIR}"/"${CONFIG_FILE}" > "${CATALINA_HOME}/conf/${CONFIG_FILE}"
+    
+    # since autodeploy is disabled by default, we need to enable it if the user has not provided a custom server.xml
+    if [ "${CONFIG_FILE}" = "server.xml" ] && [ "${ROOT_WEBAPP_REDIRECT}" = "true" ] && [ "${WEBAPP_CONTEXT}" != "" ]; then
+       echo "Deploying ROOT context to allow for redirect to ${WEBAPP_CONTEXT}"
+       sed -i '\:</Host>:i\<Context override="true" docBase="ROOT" path=""></Context>' $CATALINA_HOME/conf/server.xml
+    fi
   fi
 }
 
@@ -21,20 +27,26 @@ if [ "${SKIP_DEMO_DATA}" = "true" ]; then
 fi
 
 ## Add a permanent redirect (HTTP 301) from the root webapp ("/") to geoserver web interface ("/geoserver/web")
-if [ "${ROOT_WEBAPP_REDIRECT}" = "true" ]; then
+if [ "${ROOT_WEBAPP_REDIRECT}" = "true" ] && [ "${WEBAPP_CONTEXT}" != "" ]; then
   if [ ! -d $CATALINA_HOME/webapps/ROOT ]; then
       mkdir $CATALINA_HOME/webapps/ROOT
   fi
 
   cat > $CATALINA_HOME/webapps/ROOT/index.jsp << EOF
 <%
-  final String redirectURL = "/geoserver/web/";
+  final String redirectURL = "/${WEBAPP_CONTEXT}/web/";
   response.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY);
   response.setHeader("Location", redirectURL);
 %>
 EOF
 fi
 
+# Set the HEALTHCHECK URL depending on the webapp context
+# remove duplicate forward slashes
+DEFAULT_HEALTHCHECK_URL=$(echo "localhost:8080/${WEBAPP_CONTEXT}/web/wicket/resource/org.geoserver.web.GeoServerBasePage/img/logo.png" | tr -s /)
+DEFAULT_HEALTHCHECK_URL="http://${DEFAULT_HEALTHCHECK_URL}"
+# write the healthcheck URL to a file that geoserver user has access to but is not served by tomcat
+echo "${HEALTHCHECK_URL:-$DEFAULT_HEALTHCHECK_URL}" > $CATALINA_HOME/conf/healthcheck_url.txt
 
 ## install release data directory if needed before starting tomcat
 if [ ! -z "$GEOSERVER_REQUIRE_FILE" ] && [ ! -f "$GEOSERVER_REQUIRE_FILE" ]; then
@@ -115,11 +127,11 @@ if [ "${POSTGRES_JNDI_ENABLED}" = "true" ]; then
   fi
 
   # Use a custom "context.xml" if the user mounted one into the container
-  copy_custom_config context.xml
+  copy_custom_config "context.xml"
 fi
 
 # Use a custom "server.xml" if the user mounted one into the container
-copy_custom_config server.xml
+copy_custom_config "server.xml"
 
 # Use a custom "web.xml" if the user mounted one into the container
 if [ -d "${CONFIG_OVERRIDES_DIR}" ] && [ -f "${CONFIG_OVERRIDES_DIR}/web.xml" ]; then
diff --git a/update_credentials.sh b/update_credentials.sh
index 2f22081..a0cc80e 100644
--- a/update_credentials.sh
+++ b/update_credentials.sh
@@ -10,27 +10,27 @@ if [ ${DEBUG} ]; then
 fi;
 
 # copy over default security folder to data dir (if not existing)
-if [ ! -d "${GEOSERVER_DATA_DIR}security" ]; then
-  cp -r ${CATALINA_HOME}"/webapps/"$APP_PATH_PREFIX"geoserver/data/security" ${GEOSERVER_DATA_DIR}
+if [ ! -d "${GEOSERVER_DATA_DIR}/security" ]; then
+  cp -r "${CATALINA_HOME}/webapps/geoserver/data/security" "${GEOSERVER_DATA_DIR}/"
 fi
 
 GEOSERVER_ADMIN_USER=${GEOSERVER_ADMIN_USER:-admin}
 GEOSERVER_ADMIN_PASSWORD=${GEOSERVER_ADMIN_PASSWORD:-geoserver}
 
 # templates to use as base for replacement
-USERS_XML_ORIG=${CATALINA_HOME}"/webapps/"$APP_PATH_PREFIX"geoserver/data/security/usergroup/default/users.xml"
+USERS_XML_ORIG="${CATALINA_HOME}/webapps/geoserver/data/security/usergroup/default/users.xml"
 echo "USING USERS XML ORIGINAL:" $USERS_XML_ORIG
-ROLES_XML_ORIG=${CATALINA_HOME}"/webapps/"$APP_PATH_PREFIX"geoserver/data/security/role/default/roles.xml"
+ROLES_XML_ORIG="${CATALINA_HOME}/webapps/geoserver/data/security/role/default/roles.xml"
 echo "USING ROLES XML ORIGINAL:" $ROLES_XML_ORIG
 
 # final users.xml file GeoServer data dir
-USERS_XML=${USERS_XML:-${GEOSERVER_DATA_DIR}security/usergroup/default/users.xml}
+USERS_XML=${USERS_XML:-"${GEOSERVER_DATA_DIR}/security/usergroup/default/users.xml"}
 echo "SETTING USERS XML:" $USERS_XML
 # final roles.xml file GeoServer data dir
-ROLES_XML=${ROLES_XML:-${GEOSERVER_DATA_DIR}security/role/default/roles.xml}
+ROLES_XML=${ROLES_XML:-"${GEOSERVER_DATA_DIR}/security/role/default/roles.xml"}
 echo "SETTING ROLES XML:" . $ROLES_XML
 
-CLASSPATH=$CATALINA_HOME/webapps/$APP_PATH_PREFIX"geoserver/WEB-INF/lib/"
+CLASSPATH="$CATALINA_HOME/webapps/geoserver/WEB-INF/lib/"
 
 # tmp files
 TMP_USERS=/tmp/users.xml