diff --git a/docker-images/zrok-private-access/docker-compose.yml b/docker-images/zrok-private-access/docker-compose.yml
new file mode 100644
index 00000000..37bfc227
--- /dev/null
+++ b/docker-images/zrok-private-access/docker-compose.yml
@@ -0,0 +1,25 @@
+version: '3'
+services:
+  zrok-private-access:
+    # build: .
+    image: docker.io/openziti/zrok
+    user: root
+    command: access private --bind 0.0.0.0:9191 ${ZROK_PRIVATE_ACCESS_TOKEN}
+    ports:
+      - 9191:9191
+    stdin_open: true
+    tty: true
+    volumes:
+    - ${HOME}/.zrok:/mnt/.zrok
+    environment:
+      HOME: /mnt
+      PFXLOG_NO_JSON: "true"
+      ZROK_PRIVATE_ACCESS_TOKEN:
+  busybox:
+    image: busybox
+    command: >
+      sh -c "while true; do 
+        echo 'INFO: trying wget';
+        wget -q -O - http://zrok-private-access:9191/get; 
+        sleep 3; 
+      done"
diff --git a/docker-images/zrok-private-share/docker-compose.yml b/docker-images/zrok-private-share/docker-compose.yml
new file mode 100644
index 00000000..c463800c
--- /dev/null
+++ b/docker-images/zrok-private-share/docker-compose.yml
@@ -0,0 +1,39 @@
+version: '3'
+services:
+  zrok-enable-init:
+    image: busybox
+    command: chown -Rc 65534:65534 /mnt/.zrok
+    user: root
+    volumes:
+    - zrok_env:/mnt/.zrok
+  zrok-enable:
+    depends_on: ["zrok-enable-init"]
+    image: docker.io/openziti/zrok
+    command: enable ${ZROK_ENABLE_TOKEN}
+    stdin_open: true
+    tty: true
+    volumes:
+    - zrok_env:/mnt/.zrok
+    environment:
+      HOME: /mnt
+      ZROK_ENABLE_TOKEN:
+      ZROK_API_ENDPOINT: https://api.staging.zrok.io/
+  zrok-private-share:
+    # build: .
+    image: docker.io/openziti/zrok
+    user: root
+    command: share private --headless http://httpbin-test:8080
+    depends_on: []
+    volumes:
+    - ${HOME}/.zrok:/mnt/.zrok
+    environment:
+      HOME: /mnt
+      PFXLOG_NO_JSON: "true"
+  zrok-test:
+    image: docker.io/openziti/zrok
+    command: test endpoint --verbose --address 0.0.0.0
+  httpbin-test:
+    image: mccutchen/go-httpbin  # 8080/tcp
+
+volumes:
+  zrok_env:
\ No newline at end of file
diff --git a/docker-images/zrok-public-share/docker-compose.yml b/docker-images/zrok-public-share/docker-compose.yml
new file mode 100644
index 00000000..4bdaa0dc
--- /dev/null
+++ b/docker-images/zrok-public-share/docker-compose.yml
@@ -0,0 +1,58 @@
+version: '3'
+services:
+  zrok-enable-init:
+    image: busybox
+    # matches uid:gid of "nobody" in zrok container image
+    command: chown -Rc 65534:65534 /mnt/.zrok
+    user: root
+    volumes:
+    - zrok_env:/mnt/.zrok
+  zrok-enable:
+    depends_on:
+      zrok-enable-init:
+        condition: service_completed_successfully
+    entrypoint:
+      - bash
+      - -c
+      - |
+        # set -x
+        if [[ -s /mnt/.zrok/environment.json ]]; then
+          echo "INFO: noop: zrok environment is already enabled"
+          exit 0
+        else
+          echo "INFO: running: zrok $$(sed -E 's/[a-zA-Z0-9]{12,}/************/' <<< $${@})"
+          exec zrok $${@}
+        fi
+    command: -- enable --headless ${ZROK_ENABLE_TOKEN}
+    stdin_open: true  # FIXME: remove when --headless is available
+    tty: true         # FIXME: remove when --headless is available
+    volumes:
+    - zrok_env:/mnt/.zrok
+    environment:
+      HOME: /mnt
+      ZROK_ENABLE_TOKEN:
+      ZROK_API_ENDPOINT: https://api.staging.zrok.io/
+  zrok-public-share:
+    image: docker.io/openziti/zrok
+    command: share public --headless http://httpbin-test:8080
+    depends_on:
+      zrok-enable:
+        condition: service_completed_successfully
+    volumes:
+    - zrok_env:/mnt/.zrok
+    environment:
+      HOME: /mnt
+      PFXLOG_NO_JSON: "true"
+    volumes:
+    - zrok_env:/mnt/.zrok
+    environment:
+      HOME: /mnt
+      PFXLOG_NO_JSON: "true"
+  zrok-test:
+    image: docker.io/openziti/zrok
+    command: test endpoint --address 0.0.0.0
+  httpbin-test:
+    image: mccutchen/go-httpbin  # 8080/tcp
+
+volumes:
+  zrok_env:
\ No newline at end of file