diff --git a/deploy/proxy/Dockerfile b/deploy/proxy/Dockerfile
index d4af3f2..283c676 100644
--- a/deploy/proxy/Dockerfile
+++ b/deploy/proxy/Dockerfile
@@ -2,4 +2,6 @@ FROM mitmproxy/mitmproxy:12.2.3
 
 COPY swap.py /addon/swap.py
 
-CMD ["mitmdump", "--listen-host=0.0.0.0", "--listen-port=8880", "--set=flow_detail=1", "-s", "/addon/swap.py"]
+# A host-networked deployment binds one interface. It sets the variable and
+# keeps the command.
+CMD ["sh", "-c", "exec mitmdump --listen-host=\"${SECRETS_PROXY_BIND_HOST:-0.0.0.0}\" --listen-port=8880 --set=flow_detail=1 -s /addon/swap.py"]
diff --git a/docs/deploy.md b/docs/deploy.md
index 9c9736d..b5afbfa 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -278,9 +278,11 @@ placeholder for the real credential on the way out. Two pieces run this:
 
 - **The proxy** is `ghcr.io/czpython/drukbox/proxy`: the official
   `mitmproxy/mitmproxy` image with the addon `deploy/proxy/swap.py` built in.
-  It listens on 8880 and reads the exchange address from
-  `SECRETS_EXCHANGE_URL`. A checkout can mount the addon into the official
-  image instead. It terminates TLS only for the hosts
+  It listens on 8880 at `SECRETS_PROXY_BIND_HOST`, `0.0.0.0` by default, and
+  reads the exchange address from `SECRETS_EXCHANGE_URL`. A deployment on the
+  host network sets the bind host to the one address its sandboxes dial. On a
+  public host an open listener is an open proxy. A checkout can mount the
+  addon into the official image instead. It terminates TLS only for the hosts
   that have a registered secret and tunnels every other host blind. It
   refuses a destination that resolves to a loopback, private, link-local, or
   metadata address. It makes its CA on first start and keeps it in a volume.