diff --git a/README.md b/README.md
index df76b5c590a..881fe0c79f2 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ Specify a command to run when the image start.
 By default the image run
 `renovate`.
 This option is useful to customize the image before running `renovate`.
-It must be an existing executable file on the local system.
+It must be an existing file on the local system and it must have execute permission.
 It will be mounted to the docker container.
 
 For example you can create a simple script like this one (let's call it
diff --git a/src/renovate.ts b/src/renovate.ts
index ab380e522e7..d1a6450b139 100644
--- a/src/renovate.ts
+++ b/src/renovate.ts
@@ -101,7 +101,11 @@ class Renovate {
     if (/\s/.test(this.input.token.value)) {
       throw new Error('Token MUST NOT contain whitespace');
     }
+    await this.validateConfigFileArgument();
+    await this.validateDockerCmdFileArgument();
+  }
 
+  private async validateConfigFileArgument(): Promise<void> {
     const configurationFile = this.input.configurationFile();
     if (
       configurationFile !== null &&
@@ -112,6 +116,28 @@ class Renovate {
       );
     }
   }
+
+  private async validateDockerCmdFileArgument(): Promise<void> {
+    const dockerCmdFile = this.input.getDockerCmdFile();
+    if (dockerCmdFile === null) return;
+
+    try {
+      const s = await fs.stat(dockerCmdFile);
+      if (!s.isFile)
+        throw new Error(`dockerCmdFile '${dockerCmdFile}' MUST be a file`);
+      if (
+        (s.mode & fs.constants.R_OK) === 0 ||
+        (s.mode & fs.constants.X_OK) === 0
+      )
+        throw new Error(
+          `dockerCmdFile '${dockerCmdFile}' MUST have read and execute rights`,
+        );
+    } catch (err) {
+      if (err instanceof Error && 'code' in err && err.code === 'ENOENT')
+        throw new Error(`dockerCmdFile '${dockerCmdFile}' does not exist`);
+      throw new Error(err as string);
+    }
+  }
 }
 
 export default Renovate;