diff --git a/.gitignore b/.gitignore
index 42ce9bf..a0834c0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
 access.log
 var/
 dist/
+docker-compose-private.yml
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index 3415ae5..53e7f78 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,7 +21,7 @@ FROM umputun/baseimage:app-latest
 
 COPY --from=backend /build/reproxy /srv/reproxy
 RUN chmod +x /srv/reproxy
-
+LABEL reproxy.enabled="false"
 WORKDIR /srv
 
 CMD ["/srv/reproxy"]
diff --git a/README.md b/README.md
index 3209db6..38062c4 100644
--- a/README.md
+++ b/README.md
@@ -68,10 +68,11 @@ This default can be changed with labels:
 - `reproxy.dest` - destination path. Note: this is not full url, but just the path which will be appended to container's ip:port  
 - `reproxy.ping` - ping path for the destination container.
 
-By default all containers with exposed port will be considered as routing destinations. There are 2 ways to restrict it:
+By default all containers with exposed port will be considered as routing destinations. There are 3 ways to restrict it:
 
 - Exclude some containers explicitly with `--docker.exclude`, i.e. `--docker.exclude=c1 --docker.exclude=c2 ...`
 - Allow only a particular docker network with `--docker.network`
+- Set the label `reproxy.enabled=false` or `reproxy.enabled=no`
 
 This is a dynamic provider and any change in container's status will be applied automatically.
 
diff --git a/app/discovery/provider/docker.go b/app/discovery/provider/docker.go
index d7cf817..f888d8f 100644
--- a/app/discovery/provider/docker.go
+++ b/app/discovery/provider/docker.go
@@ -162,6 +162,13 @@ func (d *Docker) listContainers() (res []containerInfo, err error) {
 			continue
 		}
 
+		if v, ok := c.Labels["reproxy.enabled"]; ok {
+			if strings.EqualFold(v, "false") || strings.EqualFold(v, "no") {
+				log.Printf("[DEBUG] skip container %s due to reproxy.enabled=%s", containerName, v)
+				continue
+			}
+		}
+
 		var ip string
 		for k, v := range c.Networks.Networks {
 			if d.Network == "" || k == d.Network { // match on network name if defined
diff --git a/app/discovery/provider/docker_test.go b/app/discovery/provider/docker_test.go
index bed5847..a9f2fca 100644
--- a/app/discovery/provider/docker_test.go
+++ b/app/discovery/provider/docker_test.go
@@ -41,6 +41,15 @@ func TestDocker_List(t *testing.T) {
 						{PrivatePort: 12345},
 					},
 				},
+				{Names: []string{"c5"}, State: "running",
+					Networks: dc.NetworkList{
+						Networks: map[string]dc.ContainerNetwork{"bridge": {IPAddress: "127.0.0.122"}},
+					},
+					Ports: []dc.APIPort{
+						{PrivatePort: 2345},
+					},
+					Labels: map[string]string{"reproxy.enabled": "false"},
+				},
 			}, nil
 		},
 	}