diff --git a/config/systems.json b/config/systems.json
index bf095d3f..d9e97d0c 100644
--- a/config/systems.json
+++ b/config/systems.json
@@ -25,7 +25,8 @@
         },
         "images": [
           "run",
-          "build"
+          "build",
+          "run-papi"
         ],
         "username": "docker_user",
         "deployment": {
diff --git a/dockerfiles/local/entrypoint.sh b/dockerfiles/local/entrypoint.sh
index 5451f551..3c7cdda6 100755
--- a/dockerfiles/local/entrypoint.sh
+++ b/dockerfiles/local/entrypoint.sh
@@ -13,9 +13,7 @@ if [ ! -z "$CMD" ]; then
   gosu ${USER} $CMD
 fi
 
-chown -R ${USER}:${USER} /sebs/
 echo "$USER ALL=(ALL:ALL) NOPASSWD: ALL" | tee /etc/sudoers.d/dont-prompt-$USER-for-password
 usermod -aG sudo ${USER}
 
 exec gosu ${USER} "$@"
-
diff --git a/dockerfiles/local/python/Dockerfile.run b/dockerfiles/local/python/Dockerfile.run
index 76847260..07064866 100755
--- a/dockerfiles/local/python/Dockerfile.run
+++ b/dockerfiles/local/python/Dockerfile.run
@@ -15,7 +15,6 @@ COPY dockerfiles/local/python/*.py /sebs/
 COPY dockerfiles/local/python/run_server.sh /sebs/
 COPY dockerfiles/local/python/timeit.sh /sebs/
 COPY dockerfiles/local/python/runners.json /sebs/
-ADD third-party/pypapi/pypapi /sebs/pypapi
 ENV PYTHONPATH=/sebs/.python_packages/lib/site-packages:$PYTHONPATH
 
 COPY dockerfiles/local/entrypoint.sh /sebs/entrypoint.sh
diff --git a/dockerfiles/local/python/Dockerfile.run-papi b/dockerfiles/local/python/Dockerfile.run-papi
new file mode 100755
index 00000000..149407d8
--- /dev/null
+++ b/dockerfiles/local/python/Dockerfile.run-papi
@@ -0,0 +1,37 @@
+ARG BASE_IMAGE
+FROM ${BASE_IMAGE}
+
+RUN deps=''\
+  && apt-get update\
+  # for route and sudo
+  && apt-get install --no-install-recommends -y make gcc libc6-dev\
+  && pip3 install cffi
+
+ADD third-party/pypapi /pypapi
+RUN cd /pypapi && python setup.py build && python pypapi/papi_build.py
+
+FROM ${BASE_IMAGE}
+
+COPY --from=0 /pypapi/ /pypapi/
+
+RUN deps=''\
+  && apt-get update\
+  # for route and sudo
+  && apt-get install --no-install-recommends -y curl gosu net-tools sudo ${deps}\
+  && apt-get purge -y --auto-remove ${deps}\
+  && pip3 install cffi minio bottle
+
+RUN mkdir -p /sebs
+COPY dockerfiles/local/run.sh /sebs/
+COPY dockerfiles/local/*.py /sebs/
+COPY dockerfiles/local/python/*.py /sebs/
+COPY dockerfiles/local/python/run_server.sh /sebs/
+COPY dockerfiles/local/python/timeit.sh /sebs/
+COPY dockerfiles/local/python/runners.json /sebs/
+ENV PYTHONPATH=/pypapi:/sebs/.python_packages/lib/site-packages:$PYTHONPATH
+
+COPY dockerfiles/local/entrypoint.sh /sebs/entrypoint.sh
+RUN chmod +x /sebs/entrypoint.sh
+RUN chmod +x /sebs/run.sh
+
+ENTRYPOINT ["/sebs/entrypoint.sh"]
diff --git a/sebs.py b/sebs.py
index ff7f7769..b4744e12 100755
--- a/sebs.py
+++ b/sebs.py
@@ -408,6 +408,11 @@ def local():
 @click.argument("benchmark-input-size", type=click.Choice(["test", "small", "large"]))
 @click.argument("output", type=str)
 @click.option("--deployments", default=1, type=int, help="Number of deployed containers.")
+@click.option(
+    "--with-papi/--no-with-papi",
+    default=True,
+    help="Start container enabled with PAPI counters.",
+)
 @click.option("--storage-configuration", type=str, help="JSON configuration of deployed storage.")
 @click.option("--measure-interval", type=int, default=-1,
               help="Interval duration between memory measurements in ms.")
@@ -417,7 +422,7 @@ def local():
     help="Remove containers after stopping.",
 )
 @simplified_common_params
-def start(benchmark, benchmark_input_size, output, deployments, storage_configuration,
+def start(benchmark, benchmark_input_size, output, deployments, with_papi, storage_configuration,
           measure_interval, remove_containers, **kwargs):
     """
     Start a given number of function instances and a storage instance.
@@ -429,6 +434,7 @@ def start(benchmark, benchmark_input_size, output, deployments, storage_configur
     )
     deployment_client = cast(sebs.local.Local, deployment_client)
     deployment_client.remove_containers = remove_containers
+    deployment_client.with_papi = with_papi
     result = sebs.local.Deployment()
     result.measurement_file = deployment_client.start_measurements(measure_interval)
 
diff --git a/sebs/local/local.py b/sebs/local/local.py
index 5a4eb18f..31dfc7a9 100644
--- a/sebs/local/local.py
+++ b/sebs/local/local.py
@@ -47,6 +47,14 @@ def remove_containers(self) -> bool:
     def remove_containers(self, val: bool):
         self._remove_containers = val
 
+    @property
+    def with_papi(self) -> bool:
+        return self._with_papi
+
+    @with_papi.setter
+    def with_papi(self, val: bool):
+        self._with_papi = val
+
     @property
     def measure_interval(self) -> int:
         return self._measure_interval
@@ -71,6 +79,7 @@ def __init__(
         self.logging_handlers = logger_handlers
         self._config = config
         self._remove_containers = True
+        self._with_papi = False
         self._memory_measurement_path: Optional[str] = None
         # disable external measurements
         self._measure_interval = -1
@@ -157,8 +166,9 @@ def package_code(
 
     def create_function(self, code_package: Benchmark, func_name: str) -> "LocalFunction":
 
-        container_name = "{}:run.local.{}.{}".format(
+        container_name = "{}:{}.local.{}.{}".format(
             self._system_config.docker_repository(),
+            "run-papi" if self._with_papi else "run",
             code_package.language_name,
             code_package.language_version,
         )
@@ -174,6 +184,12 @@ def create_function(self, code_package: Benchmark, func_name: str) -> "LocalFunc
                     self.name(), code_package.language_name
                 ),
             }
+
+        options = {}
+        # Enable PAPI counters
+        if self.with_papi:
+            options["cap_add"] = ["PERFMON"]
+
         container = self._docker_client.containers.run(
             image=container_name,
             command=f"/bin/bash /sebs/run_server.sh {self.DEFAULT_PORT}",
@@ -182,18 +198,13 @@ def create_function(self, code_package: Benchmark, func_name: str) -> "LocalFunc
             # FIXME: make CPUs configurable
             # FIXME: configure memory
             # FIXME: configure timeout
-            # cpuset_cpus=cpuset,
-            # required to access perf counters
-            # alternative: use custom seccomp profile
-            privileged=True,
-            security_opt=["seccomp:unconfined"],
             network_mode="bridge",
             # somehow removal of containers prevents checkpointing from working?
             remove=self.remove_containers,
             stdout=True,
             stderr=True,
             detach=True,
-            # tty=True,
+            **options,
         )
 
         pid: Optional[int] = None
diff --git a/tools/build_docker_images.py b/tools/build_docker_images.py
index 5a5ed046..675a323f 100755
--- a/tools/build_docker_images.py
+++ b/tools/build_docker_images.py
@@ -12,7 +12,7 @@
 parser.add_argument(
     "--deployment", default=None, choices=["local", "aws", "azure", "gcp"], action="store"
 )
-parser.add_argument("--type", default=None, choices=["build", "run", "manage"], action="store")
+parser.add_argument("--type", default=None, choices=["build", "run", "run-papi", "manage"], action="store")
 parser.add_argument("--language", default=None, choices=["python", "nodejs"], action="store")
 parser.add_argument("--language-version", default=None, type=str, action="store")
 args = parser.parse_args()