diff --git a/ocrd_lib.sh b/ocrd_lib.sh
index 35c71d3..d5b9402 100644
--- a/ocrd_lib.sh
+++ b/ocrd_lib.sh
@@ -6,15 +6,21 @@ set -o pipefail
 
 TASK=$(basename $0)
 
+cleanupremote() {
+    ssh -Tn -p "${CONTROLLERPORT}" admin@${CONTROLLERHOST} rm -fr /data/$REMOTEDIR
+}
+
 logerr() {
   logger -p user.info -t $TASK "terminating with error \$?=$? from ${BASH_COMMAND} on line $(caller)"
+  cleanupremote &
   kitodo_production_task_action_error_open
 }
 
 stopbg() {
   logger -p user.crit -t $TASK "passing SIGKILL to child $!"
+  cleanupremote
   # pass signal on to children
-  kill -KILL $!
+  kill -INT $!
 }
 
 # initialize variables, create ord-d work directory and exit if something is missing
@@ -104,15 +110,15 @@ ocrd_format_workflow() {
 
 # ocrd import from workdir
 ocrd_import_workdir() {
-  echo "echo \$\$ > $REMOTEDIR/ocrd.pid"
-  echo "if test -f '$REMOTEDIR/mets.xml'; then OV=--overwrite; else OV=; ocrd-import -i '$REMOTEDIR'; fi"
   echo "cd '$REMOTEDIR'"
+  echo "echo \$\$ > ocrd.pid"
+  echo "if test -f mets.xml; then OV=--overwrite; else OV=; ocrd-import -j 1 -i; fi"
 }
 
 ocrd_enter_workdir() {
-  echo "echo \$\$ > $REMOTEDIR/ocrd.pid"
-  echo "if test -f '$REMOTEDIR/mets.xml'; then OV=--overwrite; else OV=; fi"
   echo "cd '$REMOTEDIR'"
+  echo "echo \$\$ > ocrd.pid"
+  echo "if test -f mets.xml; then OV=--overwrite; else OV=; fi"
 }
 
 ocrd_process_workflow() {
@@ -129,7 +135,7 @@ ocrd_exec() {
     for param in "$@"; do
       $param
     done
-  } | ssh -T -p "${CONTROLLERPORT}" ocrd@${CONTROLLERHOST} 2>&1
+  } | ssh -tt -p "${CONTROLLERPORT}" ocrd@${CONTROLLERHOST} 2>&1
 }
 
 pre_process_to_workdir() {
@@ -175,7 +181,8 @@ pre_clone_to_workdir() {
 
 pre_sync_workdir () {
   # copy the data explicitly from Manager to Controller
-  rsync -av -e "ssh -p $CONTROLLERPORT -l ocrd" "$WORKDIR/" $CONTROLLERHOST:/data/$REMOTEDIR
+  # use admin instead of ocrd to avoid entering worker semaphore via sshrc
+  rsync -av -e "ssh -p $CONTROLLERPORT -l admin" "$WORKDIR/" $CONTROLLERHOST:/data/$REMOTEDIR
 }
 
 ocrd_validate_workflow () {
@@ -185,9 +192,9 @@ ocrd_validate_workflow () {
 
 post_sync_workdir () {
     # copy the results back from Controller to Manager
-    rsync -av -e "ssh -p $CONTROLLERPORT -l ocrd" $CONTROLLERHOST:/data/$REMOTEDIR/ "$WORKDIR"
-    # TODO: maybe also schedule cleanup (or have a cron job delete dirs in /data which are older than N days)
-    # e.g. `ssh --port $CONTROLLERPORT ocrd@$CONTROLLERHOST rm -fr /data/"$WORKDIR"`
+    rsync -av -e "ssh -p $CONTROLLERPORT -l admin" $CONTROLLERHOST:/data/$REMOTEDIR/ "$WORKDIR"
+    # schedule cleanup
+    cleanupremote
 }
 
 post_validate_workdir() {
diff --git a/startup.sh b/startup.sh
index 7cf713d..135f0a3 100755
--- a/startup.sh
+++ b/startup.sh
@@ -1,4 +1,7 @@
 #! /bin/bash
+# avoid repeating file actions when restarting container:
+if ! grep -q ^ocrd: /etc/passwd; then
+
 cat /authorized_keys >>/.ssh/authorized_keys
 cat /id_rsa >>/.ssh/id_rsa
 
@@ -23,7 +26,7 @@ EOF
 fi
 
 # turn off the login banner
-touch /.hushlogin
+> /.hushlogin
 
 set | fgrep -ve BASH >/.ssh/environment
 
@@ -49,6 +52,9 @@ echo ocrd:*:19020:0:99999:7::: >>/etc/shadow
 /bin/sed -i '/imklog/s/^/#/' /etc/rsyslog.conf
 # rsyslog upd reception on port 514
 /bin/sed -i '/imudp/s/^#//' /etc/rsyslog.conf
+
+fi
+
 # start syslog
 service rsyslog start