diff --git a/Dockerfile b/Dockerfile
index 60e763b70d..db17bdd1c4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,36 +22,32 @@ RUN pnpm run build
 # Create default directories
 RUN mkdir -p /app/workspaces /root/.local/share/keyrings
 
-# Configure Nginx proxy to force local spoofing behind Dokploy/Traefik
-RUN cat << 'EOF' > /etc/nginx/sites-available/default
-server {
-    listen 3080;
-    location / {
-        proxy_pass http://127.0.0.1:3081;
-        proxy_set_header Host 127.0.0.1:3081;
-        proxy_set_header Origin http://127.0.0.1:3081;
-        proxy_set_header Referer http://127.0.0.1:3081/;
-        proxy_set_header X-Real-IP 127.0.0.1;
-        proxy_set_header X-Forwarded-For 127.0.0.1;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-}
-EOF
+# Configure Nginx proxy with spoofed headers
+RUN echo 'server { \
+    listen 3080; \
+    location / { \
+        proxy_pass http://127.0.0.1:3081; \
+        proxy_set_header Host 127.0.0.1:3081; \
+        proxy_set_header Origin http://127.0.0.1:3081; \
+        proxy_set_header Referer http://127.0.0.1:3081/; \
+        proxy_set_header X-Real-IP $remote_addr; \
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; \
+        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; \
+        proxy_http_version 1.1; \
+        proxy_set_header Upgrade $http_upgrade; \
+        proxy_set_header Connection "upgrade"; \
+    } \
+}' > /etc/nginx/sites-available/default
 
-# Create startup script via Heredoc to prevent shell syntax errors
-RUN cat << 'EOF' > /app/entrypoint.sh
-#!/bin/bash
-nginx
-eval $(dbus-launch --sh-syntax)
-export DBUS_SESSION_BUS_ADDRESS
-eval $(echo "" | gnome-keyring-daemon --unlock --components=secrets)
-export GNOME_KEYRING_CONTROL
-exec node --import tsx/esm apps/cli/src/bin.ts web --port 3081 --no-open
-EOF
-
-RUN chmod +x /app/entrypoint.sh
+# Create startup script to initialize the headless DBus + Keyring session
+RUN echo '#!/bin/bash\n\
+nginx\n\
+eval $(dbus-launch --sh-syntax)\n\
+export DBUS_SESSION_BUS_ADDRESS\n\
+eval $(echo "" | gnome-keyring-daemon --unlock --components=secrets)\n\
+export GNOME_KEYRING_CONTROL\n\
+exec node --import tsx/esm apps/cli/src/bin.ts web --port 3081 --no-open\n\
+' > /app/entrypoint.sh && chmod +x /app/entrypoint.sh
 
 EXPOSE 3080