diff --git a/python/deploy.py b/python/deploy.py
index 1c37552..e60da71 100644
--- a/python/deploy.py
+++ b/python/deploy.py
@@ -8,9 +8,12 @@ BASE = "/opt/fw"
 APP = f"{BASE}/app"
 CONF = f"{APP}/fw.conf"
 STATE = f"{APP}/state.json"
-WALLARM_IMAGE = os.environ.get("WALLARM_IMAGE", "wallarm/node:6.13.0")
-DOCKER_BIN_URL = os.environ.get("DOCKER_BIN_URL", "")
+DOCKER_DIR = f"{BASE}/docker"
 OFFLINE_DIR = f"{BASE}/offline"
+WALLARM_IMAGE = os.environ.get("WALLARM_IMAGE", "wallarm/node:6.13.0")
+
+# Ensure Docker is in PATH
+os.environ["PATH"] = f"{DOCKER_DIR}/bin:{os.environ.get('PATH', '')}"
 
 def run(cmd, timeout=120):
     return subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
diff --git a/setup.sh b/setup.sh
index f390b86..517d546 100644
--- a/setup.sh
+++ b/setup.sh
@@ -1,99 +1,105 @@
 #!/bin/bash
 # ==============================================================================
-# Wallarm Deployment Bootstrap
+# Wallarm Docker Deployment Bootstrap
 # ==============================================================================
-# Installs Python 3.12 via pyenv (cross-distro), then runs deploy.py.
+# Flow: check connectivity → install Docker → download deploy script
+# All under /opt/fw/ — self-contained, user-editable config.
+#
 #   curl -fsSL ".../setup.sh" | bash
-#   sudo /opt/fw/deploy.py
+#   sudo /opt/fw/deploy.sh
 # ==============================================================================
 set -euo pipefail
 
 BOLD='\033[1m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; NC='\033[0m'
-REPO="https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/python"
+REPO="https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main"
 WALLARM_DIR="/opt/fw"
-APP_DIR="${WALLARM_DIR}/app"
+OFFLINE_DIR="${WALLARM_DIR}/offline"
 
 echo -e "${BOLD}Wallarm Bootstrap${NC}"
 
-# ── Install curl/git if missing ───────────────────────────────────────
-if ! command -v curl >/dev/null 2>&1 && ! command -v wget >/dev/null 2>&1; then
+# ── 1. Connectivity check ─────────────────────────────────────────────
+echo -e "${YELLOW}Checking connectivity...${NC}"
+if curl -fsSL --connect-timeout 5 -o /dev/null https://git.sechpoint.app 2>/dev/null; then
+    echo -e "${GREEN}  git.sechpoint.app reachable${NC}"
+else
+    echo -e "${RED}  Cannot reach git.sechpoint.app${NC}"
+    echo -e "${RED}  Check network/firewall. Aborting.${NC}"
+    exit 1
+fi
+
+# ── 2. Ensure curl (for downloads) ────────────────────────────────────
+if ! command -v curl >/dev/null 2>&1; then
     apt-get update -qq 2>/dev/null && apt-get install -y -qq curl 2>/dev/null || true
 fi
 
-# ── Ensure Python 3.10+ is available ─────────────────────────────────
+# ── 3. Ensure Python 3.10+ ────────────────────────────────────────────
 PYTHON_BIN=""
 if command -v python3 >/dev/null 2>&1 && python3 -c "import sys; exit(0 if sys.version_info >= (3,10) else 1)" 2>/dev/null; then
     PYTHON_BIN="python3"
-elif [ -f "$HOME/.pyenv/versions/3.12.0/bin/python3" ]; then
-    PYTHON_BIN="$HOME/.pyenv/versions/3.12.0/bin/python3"
 else
     echo -e "${YELLOW}Installing Python 3...${NC}"
-    # Try distro package first (fast)
-    if command -v apt-get >/dev/null 2>&1; then
-        apt-get update -qq && apt-get install -y -qq python3 2>/dev/null
-    elif command -v yum >/dev/null 2>&1; then
-        yum install -y -q python3 2>/dev/null
-    elif command -v dnf >/dev/null 2>&1; then
-        dnf install -y -q python3 2>/dev/null
-    elif command -v apk >/dev/null 2>&1; then
-        apk add --no-cache python3 2>/dev/null
-    fi
-    if command -v python3 >/dev/null 2>&1; then
-        PYTHON_BIN="python3"
-    else
-        # Last resort: pyenv (slow but works anywhere)
-        echo -e "${YELLOW}Building Python via pyenv (3-5 min)...${NC}"
-        apt-get install -y -qq make build-essential libssl-dev zlib1g-dev \
-            libbz2-dev libreadline-dev libsqlite3-dev libffi-dev liblzma-dev 2>/dev/null || true
-        curl -fsSL https://pyenv.run | bash 2>/dev/null
-        export PYENV_ROOT="$HOME/.pyenv"
-        export PATH="$PYENV_ROOT/bin:$PATH"
-        eval "$(pyenv init -)" 2>/dev/null
-        pyenv install 3.12.0 -s 2>/dev/null
-        pyenv global 3.12.0
-        PYTHON_BIN="$HOME/.pyenv/versions/3.12.0/bin/python3"
-    fi
+    apt-get update -qq 2>/dev/null && apt-get install -y -qq python3 2>/dev/null || \
+    yum install -y -q python3 2>/dev/null || \
+    dnf install -y -q python3 2>/dev/null || \
+    apk add --no-cache python3 2>/dev/null || true
+    PYTHON_BIN="python3"
 fi
-
 echo -e "${GREEN}Python: $($PYTHON_BIN --version)${NC}"
 
-# ── Download deploy.py + wrapper ─────────────────────────────────────
-mkdir -p "$APP_DIR"
-if command -v curl >/dev/null 2>&1; then
-    curl -fsSL "${REPO}/deploy.py" -o "${APP_DIR}/main.py"
-    curl -fsSL "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/deploy.sh" -o "${WALLARM_DIR}/deploy.sh"
-else
-    wget -q "${REPO}/deploy.py" -O "${APP_DIR}/main.py"
-    wget -q "https://git.sechpoint.app/customer-engineering/wallarm/raw/branch/main/deploy.sh" -O "${WALLARM_DIR}/deploy.sh"
-fi
-chmod +x "${APP_DIR}/main.py" "${WALLARM_DIR}/deploy.sh"
-
-# ── Install Docker ───────────────────────────────────────────────────
-OFFLINE_DIR="${WALLARM_DIR}/offline"
+# ── 4. Install Docker under /opt/fw/docker/ ───────────────────────────
+DOCKER_DIR="${WALLARM_DIR}/docker"
 if ! command -v docker >/dev/null 2>&1; then
-    echo -e "${YELLOW}Installing Docker...${NC}"
+    echo -e "${YELLOW}Installing Docker under ${DOCKER_DIR}...${NC}"
+    mkdir -p "${DOCKER_DIR}/bin" "${DOCKER_DIR}/data"
+    
     if [ -f "${OFFLINE_DIR}/docker-29.2.1.tgz" ]; then
         echo -e "${GREEN}  Using offline binary${NC}"
-        tar -xzf "${OFFLINE_DIR}/docker-29.2.1.tgz" -C /usr/local/bin/
-        dockerd &>/dev/null & sleep 2
-    elif [ -n "${DOCKER_BIN_URL:-}" ] && [ -f "${OFFLINE_DIR}/docker.tgz" ]; then
-        tar -xzf "${OFFLINE_DIR}/docker.tgz" -C /usr/local/bin/
-        dockerd &>/dev/null & sleep 2
+        tar -xzf "${OFFLINE_DIR}/docker-29.2.1.tgz" -C "${DOCKER_DIR}/bin/"
     elif command -v apt-get >/dev/null 2>&1; then
         apt-get install -y -qq docker.io 2>/dev/null
+        cp /usr/bin/docker* "${DOCKER_DIR}/bin/" 2>/dev/null || true
+        cp /usr/bin/dockerd* "${DOCKER_DIR}/bin/" 2>/dev/null || true
     elif command -v yum >/dev/null 2>&1; then
         yum install -y -q docker 2>/dev/null
+        cp /usr/bin/docker* "${DOCKER_DIR}/bin/" 2>/dev/null || true
+    fi
+    
+    # Start dockerd with custom data root
+    if [ -x "${DOCKER_DIR}/bin/dockerd" ]; then
+        "${DOCKER_DIR}/bin/dockerd" --data-root "${DOCKER_DIR}/data" \
+            --exec-root "${DOCKER_DIR}/exec" --pidfile "${DOCKER_DIR}/docker.pid" \
+            &>/dev/null &
+        sleep 3
+        export PATH="${DOCKER_DIR}/bin:$PATH"
     fi
-    systemctl enable docker 2>/dev/null || true
-    systemctl start docker 2>/dev/null || true
 fi
 
-# ── Pre-cache Wallarm image ───────────────────────────────────────────
-if [ -f "${OFFLINE_DIR}/wallarm-node.tar" ]; then
-    echo -e "${YELLOW}Loading offline Wallarm image...${NC}"
-    docker load -i "${OFFLINE_DIR}/wallarm-node.tar" 2>/dev/null || true
+# ── 5. Pre-load Wallarm image if available ────────────────────────────
+if command -v docker >/dev/null 2>&1; then
+    if [ -f "${OFFLINE_DIR}/wallarm-node.tar" ]; then
+        echo -e "${YELLOW}Loading offline Wallarm image...${NC}"
+        docker load -i "${OFFLINE_DIR}/wallarm-node.tar" 2>/dev/null || true
+    fi
 fi
 
+# ── 6. Download deploy script ─────────────────────────────────────────
+APP_DIR="${WALLARM_DIR}/app"
+mkdir -p "${APP_DIR}"
+echo -e "${YELLOW}Downloading deploy script...${NC}"
+curl -fsSL "${REPO}/python/deploy.py" -o "${APP_DIR}/main.py"
+curl -fsSL "${REPO}/../deploy.sh" -o "${WALLARM_DIR}/deploy.sh" 2>/dev/null || {
+    # Fallback: create wrapper
+    cat > "${WALLARM_DIR}/deploy.sh" << 'WRAPPER'
+#!/bin/bash
+exec python3 /opt/fw/app/main.py "$@"
+WRAPPER
+}
+chmod +x "${APP_DIR}/main.py" "${WALLARM_DIR}/deploy.sh"
+
 echo
 echo -e "${GREEN}${BOLD}Ready!${NC}"
 echo -e "  ${GREEN}sudo /opt/fw/deploy.sh${NC}"
+echo
+echo -e "  Config: /opt/fw/app/fw.conf"
+echo -e "  Docker: /opt/fw/docker/"
+echo -e "  Offline: /opt/fw/offline/ (drop binaries here for air-gapped)"