diff --git a/deploy/docker/Dockerfile.backend b/deploy/docker/Dockerfile.backend
index 9ea94fa..d1e1956 100644
--- a/deploy/docker/Dockerfile.backend
+++ b/deploy/docker/Dockerfile.backend
@@ -11,6 +11,11 @@ COPY backend/ backend/
 RUN dotnet publish backend/LowCodePlatform.Backend.csproj -c Release -o /app/publish /p:UseAppHost=false
 
 FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
+# curl: docker compose healthcheck (no curl in base aspnet image)
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
 WORKDIR /app
 
 COPY --from=build /app/publish .
diff --git a/deploy/docker/docker-compose.yml b/deploy/docker/docker-compose.yml
index d1e1620..dec39c3 100644
--- a/deploy/docker/docker-compose.yml
+++ b/deploy/docker/docker-compose.yml
@@ -22,13 +22,20 @@ services:
       - lowcode-data:/data
     expose:
       - "8080"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 20s
 
   frontend:
     build:
       context: ../..
       dockerfile: deploy/docker/Dockerfile.frontend
     depends_on:
-      - backend
+      backend:
+        condition: service_healthy
     ports:
       - "8080:80"
 
diff --git a/docs/live/container-deploy.md b/docs/live/container-deploy.md
index 0b6afd6..a0e9d23 100644
--- a/docs/live/container-deploy.md
+++ b/docs/live/container-deploy.md
@@ -18,6 +18,7 @@ docker-compose -f deploy/docker/docker-compose.yml up --build -d
 
 A `.dockerignore` kizárja a **`frontend/.angular`** cache mappát — nélküle a build context Windows-on könnyen több száz MB, és a `docker build` megbízhatatlan lehet.
 
+- **Indítási sorrend:** a backend konténerben **`GET /health`** alapú healthcheck fut; a frontend (nginx) **`depends_on: service_healthy`** miatt csak ezután indul — elkerülhető az első kérések 502-je. A runtime image-ben **`curl`** van a healthcheckhez (`Dockerfile.backend`).
 - **UI + API proxy:** http://localhost:8080 — az nginx a `/api/*` kéréseket a backend konténernek adja (8080).
 - **Tenant:** `localhost` host esetén a backend a **`default`** tenant slugot használja (`TenantContext`), a compose példa ehhez ad `Tenancy__Secrets__default` connection stringet.
 - **Adat:** SQLite fájlok a `lowcode-data` Docker volume-ban (`/data` a backend konténerben).