diff --git a/.github/workflows/docker-build-push.yml b/.github/workflows/docker-build-push.yml
index a3d2335..0fab970 100644
--- a/.github/workflows/docker-build-push.yml
+++ b/.github/workflows/docker-build-push.yml
@@ -3,6 +3,15 @@ on:
   pull_request:
   push:
     branches: [ "main" ]
+    # Only files that end up in the image republish it. Pull requests stay
+    # unfiltered so the required "build" check always reports.
+    paths:
+      - 'Dockerfile'
+      - 'script.sh'
+      - 'mfa.sh'
+      - 'aws-role-credentials'
+      - 'aws-mfa-session'
+      - '.github/workflows/docker-build-push.yml'
     tags:
       - 'prod-*'
 env:
diff --git a/Readme.md b/Readme.md
index cfa6660..dc48eb9 100644
--- a/Readme.md
+++ b/Readme.md
@@ -19,11 +19,34 @@ function dev() {
         docker_cmd+=" -e PORTUNUS_TOKEN=${PORTUNUS_TOKEN}/$1"
     fi
 
+    # Name the container dev-<project>-<stage> (or dev-<dirname>) so it can be found with docker ps / docker exec
+    local base name n=1
+    if [ "$#" -eq 1 ]; then
+        base="dev-${1%%/*}-${1#*/}"
+    else
+        base="dev-$(basename "$PWD")"
+    fi
+    base=${base//[^a-zA-Z0-9_.-]/-}
+    name=$base
+    while sudo docker ps --format '{{.Names}}' | grep -qx "$name"; do n=$((n+1)); name="$base-$n"; done
+    docker_cmd+=" --name $name --hostname $name"
+
     docker_cmd+=" --entrypoint /script.sh ashishjullia19/docker-dev-env"
     eval $docker_cmd
 }
 ```
 
+## Container names
+
+Each container is named `dev-<project>-<stage>` (or `dev-<dirname>` when run without a project). If that name is already running, `-2`, `-3` and so on are added. The name is also the hostname, so the shell prompt shows which container you are in.
+
+```bash
+docker ps --filter name=dev-
+docker exec -it <name> /script.sh
+```
+
+A plain `docker exec -it <name> bash` does not see the Portunus variables, because `script.sh` exports them only into the shell it starts. Run `/script.sh` through `docker exec` to get the same environment. It asks for the MFA code again when the project has `AWS_MFA_SERIAL`.
+
 ## With portunus integration:
 
 For `PORTUNUS_TOKEN` make sure to grab this from portunus ui `portunus.ashishjullia.com` and you'll get the token in format: