diff --git a/.dockerfunc b/.dockerfunc
index 40424ce..51c8d2a 100755
--- a/.dockerfunc
+++ b/.dockerfunc
@@ -65,7 +65,7 @@ android-studio() {
            -v $ANDROID_DIR:/workspace \
            -v $ANDROID_DIR/.docker-dev/.studio-home:/home/developer/.AndroidStudio1.2 \
            -v $ANDROID_DIR/.docker-dev/.android:/home/developer/.android \
-           ${DOCKER_REPO_PREFIX}/android-studio3:latest \
+           ${DOCKER_REPO_PREFIX}/android:3 \
            /bin/studio
 
     #exit 0;
@@ -442,6 +442,41 @@ openvpn() {
            ${DOCKER_REPO_PREFIX}/openvpn:latest config.ovpn
 }
 
+papyrus() {
+    # del_stopped papyrus
+
+    MYUSERID=$(id --user)
+
+    echo "starting papyrus with uid"
+    echo $MYUSERID
+
+           #     -v $BASE/.eclipse:/home/eclipse/.eclipse/ \
+           # -v $BASE/.gradle:/home/eclipse/.gradle/ \
+           # -v $BASE/.egradle:/home/eclipse/.egradle/ \
+           # -v $BASE/plugins:/opt/eclipse/plugins/ \
+           # -v $BASE/configuration:/opt/eclipse/configuration \
+
+
+    local BASE="/media/driveBay/Backups/eclipse-configs/oxygen_configs"
+    docker run -it \
+           --net host \
+           --name="papyrus" \
+           -v /tmp/.X11-unix:/tmp/.X11-unix \
+           -e DISPLAY=unix$DISPLAY \
+           -v $HOME/projects/java/workspace:/home/eclipse/workspace \
+           -v /var/run/docker.sock:/var/run/docker.sock \
+           -v $(which docker):/bin/docker \
+           --user $MYUSERID \
+           --device /dev/video0 \
+           --group-add audio \
+           --group-add video \
+           ${DOCKER_REPO_PREFIX}/papyrus:latest \
+           sh -c "/opt/eclipse/eclipse"
+
+    #    exit 0;
+}
+
+
 
 pulseaudio() {
     del_stopped pulseaudio
diff --git a/README.md b/README.md
index 5a6a3f5..2130292 100755
--- a/README.md
+++ b/README.md
@@ -4,13 +4,15 @@ some stuff that makes my linux life more portable and comfortable.
 for debian, or debian-based distros. using i3wm.org on the desktop.
 also uses containers.
 
-strongly inspired by awesome work by https://github.com/jessfraz
+strongly inspired by awesome work of https://github.com/jessfraz
 
 ## Notes
 
+First Rule of Data: Always have Backups!
 
 ### Security
 
+
 #### Hardening ssh
 
 - https://blog.g3rt.nl/upgrade-your-ssh-keys.html
@@ -46,6 +48,8 @@ $ ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_host_$(date +%Y-%m-%d) -C "Key to H
 #### GnuPG
 
 - https://wiki.mozilla.org/Security/Key_Management
+- https://keyring.debian.org/creating-key.html
+- https://wiki.debian.org/Subkeys
 
 `~/.gnupg/gpg.conf`:
 
@@ -57,6 +61,16 @@ default-preference-list SHA512 SHA384 AES256 ZLIB BZIP2 ZIP Uncompressed
 keyid-format 0xlong
 ```
 
+#### Managing logins/passphrases
+
+- use keepass2
+
+#### Backup Secure Keys
+
+- get 2 USB Thumb drives
+- on each, create 2 partitions (ext4, you will never use them on any windows device anyway)
+- https://wiki.archlinux.org/index.php/Dm-crypt/Device_Encryption
+
 ## TODO
 
 - [ ] explain setup, ideas, practises
diff --git a/install.sh b/install.sh
index e0d0d3b..5fb836e 100755
--- a/install.sh
+++ b/install.sh
@@ -8,17 +8,18 @@ USERNAME=fschl
 
 apt_sources() {
     DIST="${$1:-stable}"
-    cat <<-EOF > /etc/apt/sources.list
-deb http://ftp.de.debian.org/debian/ ${DIST} main contrib non-free
-
-deb http://security.debian.org/ ${DIST}/updates main contrib non-free
+    if [[ ! "stable" -eq ${DIST} ]]; then
 
+    else
+        cat <<-EOF > /etc/apt/sources.list
+deb http://ftp.de.debian.org/debian/ stable main contrib
+deb http://ftp.de.debian.org/debian/ stable-updates main contrib
+deb http://security.debian.org/ stable/updates main
 EOF
 
 }
 
 base_applications() {
-
     echo "update and installing baseapps..."
 
     apt update
@@ -120,9 +121,16 @@ no_suspend() {
 }
 
 install_i3() {
-
     echo "update and installing i3wm and some tools..."
 
+    # tlp: Advanced Linux Power Management
+    # http://linrunner.de/en/tlp/docs/tlp-linux-advanced-power-management.html
+    deb http://repo.linrunner.de/debian sid main
+    fi
+
+    # add the tlp apt-repo gpg key
+    apt-key adv --keyserver pool.sks-keyservers.net --recv-keys CD4E8809
+
     DEBIAN_FRONTEND=noninteractive
 
     apt update