diff --git a/Dockerfile b/Dockerfile
index 075b956..551f13a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,4 @@
-FROM centurylink/ca-certs
-MAINTAINER CenturyLink Labs <innovationslab@ctl.io>
-LABEL "com.centurylinklabs.watchtower"="true"
+FROM ubuntu:14.04
 
 COPY watchtower /
 ENTRYPOINT ["/watchtower"]
diff --git a/README.md b/README.md
index c77ed4f..f17f826 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Watchtower
 ![Watchtower](http://panamax.ca.tier3.io/zodiac/logo-watchtower_thumb.png)
 
-[![Circle CI](https://circleci.com/gh/CenturyLinkLabs/watchtower.svg?style=svg)](https://circleci.com/gh/CenturyLinkLabs/watchtower)&nbsp; 
+[![Circle CI](https://circleci.com/gh/CenturyLinkLabs/watchtower.svg?style=svg)](https://circleci.com/gh/CenturyLinkLabs/watchtower)&nbsp;
 [![GoDoc](https://godoc.org/github.com/CenturyLinkLabs/watchtower?status.svg)](https://godoc.org/github.com/CenturyLinkLabs/watchtower)&nbsp;
 [![](https://badge.imagelayers.io/centurylink/watchtower:latest.svg)](https://imagelayers.io/?images=centurylink/watchtower:latest 'Get your own badge on imagelayers.io')
 
@@ -39,6 +39,16 @@ docker run -d \
   centurylink/watchtower
 ```
 
+For private images:
+
+```
+docker run -d \
+  --name watchtower \
+  -e REPO_USER="username" -e REPO_PASS="pass" -e REPO_EMAIL="email" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  drud/watchtower container_to_watch --debug
+```
+
 ### Arguments
 
 By default, watchtower will monitor all containers running within the Docker daemon to which it is pointed (in most cases this will be the local Docker daemon, but you can override it with the `--host` option described in the next section). However, you can restrict watchtower to monitoring a subset of the running containers by specifying the container names as arguments when launching watchtower.
diff --git a/container/client.go b/container/client.go
index 2196784..8e1605f 100644
--- a/container/client.go
+++ b/container/client.go
@@ -3,6 +3,7 @@ package container
 import (
 	"crypto/tls"
 	"fmt"
+	"os"
 	"time"
 
 	log "github.com/Sirupsen/logrus"
@@ -13,6 +14,10 @@ const (
 	defaultStopSignal = "SIGTERM"
 )
 
+var username = os.Getenv("REPO_USER")
+var password = os.Getenv("REPO_PASS")
+var email = os.Getenv("REPO_EMAIL")
+
 // A Filter is a prototype for a function that can be used to filter the
 // results from a call to the ListContainers() method on the Client.
 type Filter func(Container) bool
@@ -111,7 +116,19 @@ func (client dockerClient) StartContainer(c Container) error {
 
 	log.Infof("Starting %s", name)
 
-	newContainerID, err := client.api.CreateContainer(config, name)
+	var err error
+	var newContainerID string
+	if username != "" && password != "" && email != "" {
+		auth := dockerclient.AuthConfig{
+			Username: username,
+			Password: password,
+			Email:    email,
+		}
+		newContainerID, err = client.api.CreateContainer(config, name, &auth)
+	} else {
+		newContainerID, err = client.api.CreateContainer(config, name, nil)
+	}
+
 	if err != nil {
 		return err
 	}
@@ -132,9 +149,22 @@ func (client dockerClient) IsContainerStale(c Container) (bool, error) {
 
 	if client.pullImages {
 		log.Debugf("Pulling %s for %s", imageName, c.Name())
-		if err := client.api.PullImage(imageName, nil); err != nil {
-			return false, err
+
+		if username != "" && password != "" && email != "" {
+			auth := dockerclient.AuthConfig{
+				Username: username,
+				Password: password,
+				Email:    email,
+			}
+			if err := client.api.PullImage(imageName, &auth); err != nil {
+				return false, err
+			}
+		} else {
+			if err := client.api.PullImage(imageName, nil); err != nil {
+				return false, err
+			}
 		}
+
 	}
 
 	newImageInfo, err := client.api.InspectImage(imageName)
@@ -153,7 +183,7 @@ func (client dockerClient) IsContainerStale(c Container) (bool, error) {
 func (client dockerClient) RemoveImage(c Container) error {
 	imageID := c.ImageID()
 	log.Infof("Removing image %s", imageID)
-	_, err := client.api.RemoveImage(imageID)
+	_, err := client.api.RemoveImage(imageID, true)
 	return err
 }