diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0b9ff25..d87fa26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,13 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Added
+
+- `EASY_PROXY_DOCKER_RUN_OPTS` — extra options passed through to the `docker run`
+  of `easy proxy create` (extra published ports, resource limits, etc.).
+
 ## [2.2.0] — 2026-05-18
 
 ### Added
diff --git a/CLAUDE.md b/CLAUDE.md
index 70300b0..903d84b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -114,6 +114,10 @@ Opzionale — `EASY_PROXY_NETWORK`: se impostata, `easy proxy create` aggancia i
 container a quella rete Docker (creata se non esiste) e ricrearlo non perde la
 connettività verso i backend. I siti si collegano con `easy proxy attach`.
 
+Opzionale — `EASY_PROXY_DOCKER_RUN_OPTS`: opzioni extra passate al `docker run`
+di `easy proxy create` (porte aggiuntive, limiti di risorse, ecc.). Es:
+`export EASY_PROXY_DOCKER_RUN_OPTS="-p 8089:8089"`.
+
 ### Build immagine locale
 
 Il `Dockerfile` è self-contained (`FROM certbot/certbot:latest`): un solo build,
diff --git a/commands/proxy.sh b/commands/proxy.sh
index 02dae5e..5eb4970 100644
--- a/commands/proxy.sh
+++ b/commands/proxy.sh
@@ -368,6 +368,9 @@ function __easy_command_proxy_create {
   fi
   network_args=(--network "${EASY_PROXY_NETWORK}")
  fi
+ # Extra `docker run` options the operator wants (extra ports, limits, ...).
+ local run_opts=()
+ read -ra run_opts <<< "${EASY_PROXY_DOCKER_RUN_OPTS}"
  docker run -d \
  --name "${EASY_PROXY_NAME}" \
  "${network_args[@]}" \
@@ -376,6 +379,7 @@ function __easy_command_proxy_create {
  -v "${EASY_DIR}/easyhome:/usr/local/share/easy" \
  -p 80:80 \
  -p 443:443 \
+ "${run_opts[@]}" \
  -t ethiclab/nginx-easy || return $?
  # `docker run` only starts the container — nginx can still crash on a bad
  # config. Give it a moment, then verify the proxy is actually serving.
diff --git a/test/create.bats b/test/create.bats
new file mode 100644
index 0000000..990a3a1
--- /dev/null
+++ b/test/create.bats
@@ -0,0 +1,36 @@
+#!/usr/bin/env bats
+# Tests for `easy proxy create` configuration knobs.
+
+load test_helper
+
+setup() { easy_setup; }
+
+@test "easy proxy create passes EASY_PROXY_DOCKER_RUN_OPTS to docker run" {
+  export EASY_PROXY_DOCKER_RUN_OPTS="-p 8089:8089"
+  export DOCKER_LOG="$BATS_TEST_TMPDIR/docker.log"
+  export DOCKER_PROXY_HEALTHY=1
+  mock_docker_lifecycle
+  run easy proxy create
+  [ "$status" -eq 0 ]
+  grep -q -- "-p 8089:8089" "$DOCKER_LOG"
+}
+
+@test "easy proxy create passes multiple EASY_PROXY_DOCKER_RUN_OPTS tokens" {
+  export EASY_PROXY_DOCKER_RUN_OPTS="-p 8089:8089 --memory 512m"
+  export DOCKER_LOG="$BATS_TEST_TMPDIR/docker.log"
+  export DOCKER_PROXY_HEALTHY=1
+  mock_docker_lifecycle
+  run easy proxy create
+  [ "$status" -eq 0 ]
+  grep -q -- "-p 8089:8089" "$DOCKER_LOG"
+  grep -q -- "--memory 512m" "$DOCKER_LOG"
+}
+
+@test "easy proxy create works with EASY_PROXY_DOCKER_RUN_OPTS unset" {
+  export DOCKER_LOG="$BATS_TEST_TMPDIR/docker.log"
+  export DOCKER_PROXY_HEALTHY=1
+  mock_docker_lifecycle
+  run easy proxy create
+  [ "$status" -eq 0 ]
+  grep -q "run -d" "$DOCKER_LOG"
+}
diff --git a/test/test_helper.bash b/test/test_helper.bash
index c0357f6..9f5ff8e 100644
--- a/test/test_helper.bash
+++ b/test/test_helper.bash
@@ -27,7 +27,7 @@ easy_setup() {
   export PATH="$MOCK_BIN:$EASY_CLI_DIR:$PATH"
 
   # Deterministic: never inherit real credentials/config from the host shell.
-  unset IONOS_API_KEY IONOS_API_SECRET EASY_LETSENCRYPT_EMAIL EASY_LETSENCRYPT_DOMAIN EASY_PROXY_NETWORK
+  unset IONOS_API_KEY IONOS_API_SECRET EASY_LETSENCRYPT_EMAIL EASY_LETSENCRYPT_DOMAIN EASY_PROXY_NETWORK EASY_PROXY_DOCKER_RUN_OPTS
   # Skip the post-create verify wait — the mocks settle instantly.
   export EASY_VERIFY_DELAY=0
 }