diff --git a/Dockerfile b/Dockerfile
index b32d3da..3e5facf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
-FROM python:3.12-slim
+FROM docker.io/library/python:3.12-slim
+
 
 WORKDIR /app
 
@@ -14,7 +15,8 @@ COPY config/ ./config/
 
 EXPOSE 8100
 
-# When running standalone, override these to point at your Prometheus/Alertmanager
+# Appliance-style defaults for host-network deployment. Override via env or
+# systemd EnvironmentFile when needed.
 ENV MARVIS_PROMETHEUS_URL=http://127.0.0.1:9090
 ENV MARVIS_PROMETHEUS_PREFIX=/prometheus
 ENV MARVIS_ALERTMANAGER_URL=http://127.0.0.1:9093
diff --git a/README.md b/README.md
index 9e657b6..ec2c424 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ The target environment for this project is a host where services are started by
 `systemd`, including Docker-backed services. Marvis is intended to run the same
 way:
 
-- the FastAPI app runs on `127.0.0.1:8100`
+- the FastAPI app runs in a container with host networking on `127.0.0.1:8100`
 - Traefik exposes it at `/core/marvis/*`
 - `patch-ncm.py` injects the sidebar entries and iframe routes into the NCM UI
 - the injected entries should only be added for services that are actually
@@ -30,6 +30,8 @@ docker build -t p5g-marvis:latest .
 
 ```bash
 cp config/p5g-marvis.service /usr/lib/systemd/system/p5g-marvis.service
+mkdir -p /etc/p5g-marvis
+cp config/marvis.env.example /etc/p5g-marvis/marvis.env
 systemctl daemon-reload
 systemctl enable --now p5g-marvis
 ```
@@ -41,6 +43,14 @@ http://127.0.0.1:8100
 http://127.0.0.1:8100/api/docs
 ```
 
+Edit `/etc/p5g-marvis/marvis.env` per host instead of hardcoding addresses in the
+unit file. In particular:
+
+- set `MARVIS_PROMETHEUS_URL` and `MARVIS_ALERTMANAGER_URL` to the correct host
+  endpoints for that appliance
+- keep the defaults if Prometheus and Alertmanager are already available on host
+  loopback from the appliance network namespace
+
 ---
 
 ## Architecture Overview
diff --git a/app/__pycache__/config.cpython-314.pyc b/app/__pycache__/config.cpython-314.pyc
new file mode 100644
index 0000000..deb9faf
Binary files /dev/null and b/app/__pycache__/config.cpython-314.pyc differ
diff --git a/app/config.py b/app/config.py
index de99861..04ed460 100644
--- a/app/config.py
+++ b/app/config.py
@@ -1,6 +1,7 @@
 import os
 
-# Prometheus — the HPE P5G stack uses /prometheus as base path
+# Defaults assume the appliance-style deployment model where Marvis runs with
+# host networking and talks to sibling services over host loopback.
 PROMETHEUS_URL    = os.getenv("MARVIS_PROMETHEUS_URL",    "http://127.0.0.1:9090")
 PROMETHEUS_PREFIX = os.getenv("MARVIS_PROMETHEUS_PREFIX", "/prometheus")
 ALERTMANAGER_URL  = os.getenv("MARVIS_ALERTMANAGER_URL",  "http://127.0.0.1:9093")
@@ -11,7 +12,7 @@ OPENAI_API_KEY    = os.getenv("MARVIS_OPENAI_API_KEY",    "")
 OPENAI_MODEL      = os.getenv("MARVIS_OPENAI_MODEL",      "gpt-4o-mini")
 # Override to use any OpenAI-compatible local LLM (llama.cpp, vLLM, LM Studio, etc.)
 OPENAI_BASE_URL   = os.getenv("MARVIS_OPENAI_BASE_URL",   "https://api.openai.com")
-OLLAMA_URL        = os.getenv("MARVIS_OLLAMA_URL",        "http://localhost:11434")
+OLLAMA_URL        = os.getenv("MARVIS_OLLAMA_URL",        "http://127.0.0.1:11434")
 OLLAMA_MODEL      = os.getenv("MARVIS_OLLAMA_MODEL",      "llama3")
 
 # Container/runtime integration
diff --git a/config/marvis.env.example b/config/marvis.env.example
new file mode 100644
index 0000000..bc9e3bb
--- /dev/null
+++ b/config/marvis.env.example
@@ -0,0 +1,14 @@
+# Copy to /etc/p5g-marvis/marvis.env and edit for the target host.
+
+# Backend service URLs for the default host-network deployment model.
+MARVIS_PROMETHEUS_URL=http://127.0.0.1:9090
+MARVIS_PROMETHEUS_PREFIX=/prometheus
+MARVIS_ALERTMANAGER_URL=http://127.0.0.1:9093
+
+# AI backend configuration.
+MARVIS_AI_MODE=rule
+MARVIS_OPENAI_API_KEY=
+MARVIS_OPENAI_BASE_URL=https://api.openai.com
+MARVIS_OPENAI_MODEL=gpt-4o-mini
+MARVIS_OLLAMA_URL=http://127.0.0.1:11434
+MARVIS_OLLAMA_MODEL=llama3
diff --git a/config/p5g-marvis.service b/config/p5g-marvis.service
index 5ca076d..738ad2e 100644
--- a/config/p5g-marvis.service
+++ b/config/p5g-marvis.service
@@ -1,22 +1,28 @@
 [Unit]
 Description=P5G Marvis container
-After=docker.service network-online.target
-Requires=docker.service
+After=network-online.target
+Wants=network-online.target
 
 [Service]
 Type=simple
 Restart=always
 RestartSec=5
 TimeoutStartSec=0
+EnvironmentFile=-/etc/p5g-marvis/marvis.env
 
 ExecStartPre=-/usr/bin/docker rm -f p5g-marvis
 ExecStart=/usr/bin/docker run \
   --name p5g-marvis \
-  --publish 127.0.0.1:8100:8100 \
-  --env MARVIS_PROMETHEUS_URL=http://127.0.0.1:9090 \
-  --env MARVIS_PROMETHEUS_PREFIX=/prometheus \
-  --env MARVIS_ALERTMANAGER_URL=http://127.0.0.1:9093 \
-  --env MARVIS_AI_MODE=rule \
+  --network host \
+  --env MARVIS_PROMETHEUS_URL=${MARVIS_PROMETHEUS_URL:-http://127.0.0.1:9090} \
+  --env MARVIS_PROMETHEUS_PREFIX=${MARVIS_PROMETHEUS_PREFIX:-/prometheus} \
+  --env MARVIS_ALERTMANAGER_URL=${MARVIS_ALERTMANAGER_URL:-http://127.0.0.1:9093} \
+  --env MARVIS_AI_MODE=${MARVIS_AI_MODE:-rule} \
+  --env MARVIS_OPENAI_API_KEY=${MARVIS_OPENAI_API_KEY:-} \
+  --env MARVIS_OPENAI_BASE_URL=${MARVIS_OPENAI_BASE_URL:-https://api.openai.com} \
+  --env MARVIS_OPENAI_MODEL=${MARVIS_OPENAI_MODEL:-gpt-4o-mini} \
+  --env MARVIS_OLLAMA_URL=${MARVIS_OLLAMA_URL:-http://127.0.0.1:11434} \
+  --env MARVIS_OLLAMA_MODEL=${MARVIS_OLLAMA_MODEL:-llama3} \
   p5g-marvis:latest
 ExecStop=/usr/bin/docker stop p5g-marvis