diff --git a/.env.example b/.env.example
index 9bd0302..81a357f 100644
--- a/.env.example
+++ b/.env.example
@@ -8,10 +8,12 @@ FLASK_ENV=production
 FLASK_DEBUG=0
 
 # Datenbank
-DATABASE_PATH=./data/minicloud.db
+# Docker: /app/data/minicloud.db | Entwicklung: ./data/minicloud.db
+DATABASE_PATH=/app/data/minicloud.db
 
 # Dateispeicher
-UPLOAD_PATH=./data/files
+# Docker: /app/data/files | Entwicklung: ./data/files
+UPLOAD_PATH=/app/data/files
 
 # JWT
 # Token generieren: python3 -c "import secrets; print(secrets.token_urlsafe(64))"
diff --git a/backend/app/config.py b/backend/app/config.py
index 47b518a..bb42459 100644
--- a/backend/app/config.py
+++ b/backend/app/config.py
@@ -2,23 +2,31 @@ import os
 from datetime import timedelta
 from pathlib import Path
 
-# Project root: backend/app/config.py -> backend/app -> backend -> project_root
-basedir = Path(__file__).resolve().parent.parent.parent
+
+def _resolve_path(env_var, default_subpath):
+    """Resolve a path from environment variable.
+
+    - Absolute paths (/app/data/...) are used as-is
+    - Relative paths (./data/...) are resolved relative to CWD
+    - No env var: use default relative to CWD
+    """
+    env_val = os.environ.get(env_var, '').strip()
+    if not env_val:
+        return str(Path.cwd() / default_subpath)
+    if os.path.isabs(env_val):
+        return env_val
+    return str(Path.cwd() / env_val)
 
 
 class Config:
     SECRET_KEY = os.environ.get('SECRET_KEY', 'dev-secret-key-change-me')
 
-    # Database - always resolve relative to project root
-    _db_default = str(basedir / 'data' / 'minicloud.db')
-    _db_env = os.environ.get('DATABASE_PATH', '')
-    _db_path = str(basedir / _db_env) if _db_env and not os.path.isabs(_db_env) else (_db_env or _db_default)
-    SQLALCHEMY_DATABASE_URI = f'sqlite:///{_db_path}'
+    # Database
+    SQLALCHEMY_DATABASE_URI = f'sqlite:///{_resolve_path("DATABASE_PATH", "data/minicloud.db")}'
     SQLALCHEMY_TRACK_MODIFICATIONS = False
 
-    # File uploads - always resolve relative to project root
-    _upload_env = os.environ.get('UPLOAD_PATH', '')
-    UPLOAD_PATH = str(basedir / _upload_env) if _upload_env and not os.path.isabs(_upload_env) else (_upload_env or str(basedir / 'data' / 'files'))
+    # File uploads
+    UPLOAD_PATH = _resolve_path('UPLOAD_PATH', 'data/files')
     MAX_CONTENT_LENGTH = int(os.environ.get('MAX_UPLOAD_SIZE_MB', 500)) * 1024 * 1024
 
     # JWT