diff --git a/Dockerfile b/Dockerfile
index fc257405f3..e8694d57ce 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 FROM node:22-bookworm
 
-# Install socat to forward traffic safely inside the container
-RUN apt-get update && apt-get install -y socat && rm -rf /var/lib/apt/lists/*
+# Install Nginx to perform HTTP header rewriting inside the container
+RUN apt-get update && apt-get install -y nginx-light && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -13,8 +13,22 @@ COPY . .
 RUN pnpm install
 RUN pnpm run build
 
+# Create a dedicated default directory for workspaces
+RUN mkdir -p /app/workspaces
+
+# Configure Nginx to trick dsh web into thinking all requests originate from local loopback
+RUN echo 'server { \
+    listen 3080; \
+    location / { \
+        proxy_pass http://127.0.0.1:3081; \
+        proxy_set_header Host 127.0.0.1:3081; \
+        proxy_http_version 1.1; \
+        proxy_set_header Upgrade $http_upgrade; \
+        proxy_set_header Connection "upgrade"; \
+    } \
+}' > /etc/nginx/sites-available/default
+
 EXPOSE 3080
 
-# Forward Dokploy traffic (3080) to app loopback (3081)
-CMD socat TCP-LISTEN:3080,fork,reuseaddr TCP:127.0.0.1:3081 & \
-    node --import tsx/esm apps/cli/src/bin.ts web --port 3081 --no-open
\ No newline at end of file
+# Start Nginx and launch DeepSeek Harness
+CMD nginx && node --import tsx/esm apps/cli/src/bin.ts web --port 3081 --no-open
\ No newline at end of file