diff --git a/5.5/Dockerfile b/5.5/Dockerfile
index 58c3003..7e1e3c5 100644
--- a/5.5/Dockerfile
+++ b/5.5/Dockerfile
@@ -19,15 +19,14 @@ RUN set -eu; \
     mkdir /opt/emqx; \
     tar zxf $pkg -C /opt/emqx; \
     find /opt/emqx -name 'swagger*.js.map' -exec rm {} +; \
+    ln -s /opt/emqx/bin/* /usr/local/bin/; \
     groupadd -r -g 1000 emqx; \
     useradd -r -m -u 1000 -g emqx emqx; \
-    chgrp -Rf emqx /opt/emqx; \
-    chmod -Rf g+w /opt/emqx; \
-    chown -Rf emqx /opt/emqx; \
-    ln -s /opt/emqx/bin/* /usr/local/bin/; \
+    mkdir -p /opt/emqx/log /opt/emqx/data /opt/emqx/plugins; \
+    chown -R emqx:emqx /opt/emqx/log /opt/emqx/data /opt/emqx/plugins; \
     rm -f $pkg; \
     apt-get purge -y --auto-remove curl; \
-    rm -rf /var/lib/apt/lists/*
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 WORKDIR /opt/emqx
 
diff --git a/5.6/Dockerfile b/5.6/Dockerfile
new file mode 100644
index 0000000..9380d5e
--- /dev/null
+++ b/5.6/Dockerfile
@@ -0,0 +1,51 @@
+FROM debian:12-slim
+
+ENV EMQX_VERSION=5.6.0
+ENV AMD64_SHA256=d04535234c91dada9ae794247ccc70139c980c24a2f4609e8253c95e75b992ec
+ENV ARM64_SHA256=c40a6f7a70fce3874a4db804cb908f808a0119d77d1db324bdf3050b7429f31d
+ENV LC_ALL=C.UTF-8 LANG=C.UTF-8
+
+RUN set -eu; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates procps curl; \
+    arch=$(dpkg --print-architecture); \
+    if [ ${arch} = "amd64" ]; then sha256="$AMD64_SHA256"; fi; \
+    if [ ${arch} = "arm64" ]; then sha256="$ARM64_SHA256"; fi; \
+    . /etc/os-release; \
+    pkg="emqx-${EMQX_VERSION}-${ID}${VERSION_ID}-${arch}.tar.gz"; \
+    curl -f -O -L https://www.emqx.com/en/downloads/broker/v${EMQX_VERSION}/${pkg}; \
+    echo "$sha256 *$pkg" | sha256sum -c; \
+    mkdir /opt/emqx; \
+    tar zxf $pkg -C /opt/emqx; \
+    find /opt/emqx -name 'swagger*.js.map' -exec rm {} +; \
+    ln -s /opt/emqx/bin/* /usr/local/bin/; \
+    groupadd -r -g 1000 emqx; \
+    useradd -r -m -u 1000 -g emqx emqx; \
+    mkdir -p /opt/emqx/log /opt/emqx/data /opt/emqx/plugins; \
+    chown -R emqx:emqx /opt/emqx/log /opt/emqx/data /opt/emqx/plugins; \
+    rm -f $pkg; \
+    apt-get purge -y --auto-remove curl; \
+    apt-get clean; \
+    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+WORKDIR /opt/emqx
+
+USER emqx
+
+VOLUME ["/opt/emqx/log", "/opt/emqx/data"]
+
+# emqx will occupy these port:
+# - 1883 port for MQTT
+# - 8083 for WebSocket/HTTP
+# - 8084 for WSS/HTTPS
+# - 8883 port for MQTT(SSL)
+# - 18083 for dashboard and API
+# - 4370 default Erlang distribution port
+# - 5369 for backplain gen_rpc
+EXPOSE 1883 8083 8084 8883 18083 4370 5369
+
+COPY docker-entrypoint.sh /usr/bin/
+
+ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"]
+
+CMD ["/opt/emqx/bin/emqx", "foreground"]
diff --git a/5.6/docker-entrypoint.sh b/5.6/docker-entrypoint.sh
new file mode 100755
index 0000000..458e96c
--- /dev/null
+++ b/5.6/docker-entrypoint.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+## Shell setting
+if [[ -n "$DEBUG" ]]; then
+    set -ex
+else
+    set -e
+fi
+
+shopt -s nullglob
+
+## Local IP address setting
+
+LOCAL_IP=$(hostname -i | grep -oE '((25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])\.){3}(25[0-5]|(2[0-4]|1[0-9]|[1-9]|)[0-9])' | head -n 1)
+
+export EMQX_NAME="${EMQX_NAME:-emqx}"
+
+## EMQX_NODE_NAME or EMQX_NODE__NAME to indicate the full node name to be used by EMQX
+## If both are set EMQX_NODE_NAME takes higher precedence than EMQX_NODE__NAME
+if [[ -z "${EMQX_NODE_NAME:-}" ]] && [[ -z "${EMQX_NODE__NAME:-}" ]]; then
+    # No node name is provide from environment variables
+    # try to resolve from other settings
+    if [[ -z "$EMQX_HOST" ]]; then
+        if [[ "$EMQX_CLUSTER__DISCOVERY_STRATEGY" == "dns" ]] && \
+            [[ "$EMQX_CLUSTER__DNS__RECORD_TYPE" == "srv" ]] && \
+            grep -q "$(hostname).$EMQX_CLUSTER__DNS__NAME" /etc/hosts; then
+                EMQX_HOST="$(hostname).$EMQX_CLUSTER__DNS__NAME"
+        elif [[ "$EMQX_CLUSTER__DISCOVERY_STRATEGY" == "k8s" ]] && \
+            [[ "$EMQX_CLUSTER__K8S__ADDRESS_TYPE" == "dns" ]] && \
+            [[ -n "$EMQX_CLUSTER__K8S__NAMESPACE" ]]; then
+                EMQX_CLUSTER__K8S__SUFFIX=${EMQX_CLUSTER__K8S__SUFFIX:-"pod.cluster.local"}
+                EMQX_HOST="${LOCAL_IP//./-}.$EMQX_CLUSTER__K8S__NAMESPACE.$EMQX_CLUSTER__K8S__SUFFIX"
+        elif [[ "$EMQX_CLUSTER__DISCOVERY_STRATEGY" == "k8s" ]] && \
+            [[ "$EMQX_CLUSTER__K8S__ADDRESS_TYPE" == 'hostname' ]] && \
+            [[ -n "$EMQX_CLUSTER__K8S__NAMESPACE" ]]; then
+                EMQX_CLUSTER__K8S__SUFFIX=${EMQX_CLUSTER__K8S__SUFFIX:-'svc.cluster.local'}
+                EMQX_HOST=$(grep -h "^$LOCAL_IP" /etc/hosts | grep -o "$(hostname).*.$EMQX_CLUSTER__K8S__NAMESPACE.$EMQX_CLUSTER__K8S__SUFFIX")
+        else
+            EMQX_HOST="$LOCAL_IP"
+        fi
+        export EMQX_HOST
+    fi
+    export EMQX_NODE_NAME="$EMQX_NAME@$EMQX_HOST"
+fi
+
+# The default rpc port discovery 'stateless' is mostly for clusters
+# having static node names. So it's troulbe-free for multiple emqx nodes
+# running on the same host.
+# When start emqx in docker, it's mostly one emqx node in one container
+# i.e. use port 5369 (or per tcp_server_port | ssl_server_port config) for gen_rpc
+export EMQX_RPC__PORT_DISCOVERY="${EMQX_RPC__PORT_DISCOVERY:-manual}"
+
+exec "$@"
diff --git a/update.sh b/update.sh
index b8fcb22..cb8ca4a 100755
--- a/update.sh
+++ b/update.sh
@@ -5,8 +5,8 @@ set -eou pipefail
 VERSION="$1"
 VERSION_DIR=$(echo "$VERSION" | cut -d '.' -f 1,2 -)
 
-AMD64_SHA256=$(curl -sSL https://github.com/emqx/emqx/releases/download/v${VERSION}/emqx-${VERSION}-debian11-amd64.tar.gz.sha256)
-ARM64_SHA256=$(curl -sSL https://github.com/emqx/emqx/releases/download/v${VERSION}/emqx-${VERSION}-debian11-arm64.tar.gz.sha256)
+AMD64_SHA256=$(curl -sSL https://github.com/emqx/emqx/releases/download/v${VERSION}/emqx-${VERSION}-debian12-amd64.tar.gz.sha256)
+ARM64_SHA256=$(curl -sSL https://github.com/emqx/emqx/releases/download/v${VERSION}/emqx-${VERSION}-debian12-arm64.tar.gz.sha256)
 
 sed -i.bak \
     -e "s/EMQX_VERSION=.*/EMQX_VERSION=${VERSION}/" \