diff --git a/backend/Dockerfile.bun b/backend/Dockerfile.bun
new file mode 100644
index 0000000..55545b7
--- /dev/null
+++ b/backend/Dockerfile.bun
@@ -0,0 +1,20 @@
+FROM oven/bun:1-alpine
+
+WORKDIR /app
+
+# Install dependencies first (layer caching)
+# bun install is compatible with npm package.json / package-lock.json
+COPY package*.json ./
+RUN bun install --production
+
+# Copy application source
+COPY . .
+
+# Expose backend API port
+EXPOSE 3001
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
+  CMD bun -e "require('http').get('http://localhost:3001/api/health', r => r.statusCode === 200 ? process.exit(0) : process.exit(1)).on('error', () => process.exit(1))"
+
+CMD ["bun", "run", "server.js"]
diff --git a/proxy/netifyClient.js b/proxy/netifyClient.js
index 748d7aa..bb578f2 100644
--- a/proxy/netifyClient.js
+++ b/proxy/netifyClient.js
@@ -170,7 +170,8 @@ async function fetchFlows(limit = 10000, agentUuid = null, siteUuid = null) {
     const port = r.remote_port ?? null;
     const portService = port ? (PORT_SERVICE_MAP[port] ?? `Port ${port}`) : null;
     const appLabel = r.application?.label || portService;
-    const domain = r.tls_sni || r.dns_hostname || r.hostname || null;
+    const sniVal = typeof r.tls_sni === 'object' ? r.tls_sni?.label : r.tls_sni;
+    const domain = sniVal || r.dns_hostname || r.hostname || null;
     return {
       flow_id:    String(r.flow_id ?? ''),
       src_ip:     r.local_ip?.address  ?? null,