diff --git a/assets/components/ContainerViewer/ContainerActionsToolbar.vue b/assets/components/ContainerViewer/ContainerActionsToolbar.vue
index 8353d38e..15b77a88 100644
--- a/assets/components/ContainerViewer/ContainerActionsToolbar.vue
+++ b/assets/components/ContainerViewer/ContainerActionsToolbar.vue
@@ -135,19 +135,21 @@
         </li>
       </template>
 
-      <li class="line" v-if="host.type === 'local'"></li>
-      <li v-if="host.type === 'local'">
-        <a @click.prevent="showDrawer(Terminal, { container, action: 'attach' }, 'lg')">
-          <ri:terminal-window-fill /> Attach
-          <KeyShortcut char="a" :modifiers="['shift', 'meta']" />
-        </a>
-      </li>
-      <li v-if="host.type === 'local'">
-        <a @click.prevent="showDrawer(Terminal, { container, action: 'exec' }, 'lg')">
-          <material-symbols:terminal /> Shell
-          <KeyShortcut char="e" :modifiers="['shift', 'meta']" />
-        </a>
-      </li>
+      <template v-if="enableShell && host.type === 'local'">
+        <li class="line"></li>
+        <li>
+          <a @click.prevent="showDrawer(Terminal, { container, action: 'attach' }, 'lg')">
+            <ri:terminal-window-fill /> Attach
+            <KeyShortcut char="a" :modifiers="['shift', 'meta']" />
+          </a>
+        </li>
+        <li>
+          <a @click.prevent="showDrawer(Terminal, { container, action: 'exec' }, 'lg')">
+            <material-symbols:terminal /> Shell
+            <KeyShortcut char="e" :modifiers="['shift', 'meta']" />
+          </a>
+        </li>
+      </template>
     </ul>
   </div>
 </template>
@@ -160,7 +162,7 @@ import LogAnalytics from "../LogViewer/LogAnalytics.vue";
 import Terminal from "@/components/Terminal.vue";
 
 const { showSearch } = useSearchFilter();
-const { enableActions } = config;
+const { enableActions, enableShell } = config;
 const { streamConfig, hasComplexLogs, levels } = useLoggingContext();
 const showDrawer = useDrawer();
 
@@ -177,20 +179,21 @@ onKeyStroke("f", (e) => {
     }
   }
 });
+if (enableShell) {
+  onKeyStroke("a", (e) => {
+    if ((e.ctrlKey || e.metaKey) && e.shiftKey) {
+      showDrawer(Terminal, { container, action: "attach" }, "lg");
+      e.preventDefault();
+    }
+  });
 
-onKeyStroke("a", (e) => {
-  if ((e.ctrlKey || e.metaKey) && e.shiftKey) {
-    showDrawer(Terminal, { container, action: "attach" }, "lg");
-    e.preventDefault();
-  }
-});
-
-onKeyStroke("e", (e) => {
-  if ((e.ctrlKey || e.metaKey) && e.shiftKey) {
-    showDrawer(Terminal, { container, action: "exec" }, "lg");
-    e.preventDefault();
-  }
-});
+  onKeyStroke("e", (e) => {
+    if ((e.ctrlKey || e.metaKey) && e.shiftKey) {
+      showDrawer(Terminal, { container, action: "exec" }, "lg");
+      e.preventDefault();
+    }
+  });
+}
 
 const downloadParams = computed(() =>
   Object.entries(toValue(streamConfig))
diff --git a/assets/stores/config.ts b/assets/stores/config.ts
index fd7ba46a..6b2af8e6 100644
--- a/assets/stores/config.ts
+++ b/assets/stores/config.ts
@@ -11,6 +11,7 @@ export interface Config {
   hosts: Host[];
   authProvider: "simple" | "none" | "forward-proxy";
   enableActions: boolean;
+  enableShell: boolean;
   user?: {
     username: string;
     email: string;
diff --git a/internal/support/cli/args.go b/internal/support/cli/args.go
index 50d9a58a..41249986 100644
--- a/internal/support/cli/args.go
+++ b/internal/support/cli/args.go
@@ -22,6 +22,7 @@ type Args struct {
 	AuthHeaderName   string              `arg:"--auth-header-name,env:DOZZLE_AUTH_HEADER_NAME" default:"Remote-Name" help:"sets the HTTP Header to use for name in Forward Proxy configuration."`
 	AuthHeaderFilter string              `arg:"--auth-header-filter,env:DOZZLE_AUTH_HEADER_FILTER" default:"Remote-Filter" help:"sets the HTTP Header to use for filtering in Forward Proxy configuration."`
 	EnableActions    bool                `arg:"--enable-actions,env:DOZZLE_ENABLE_ACTIONS" default:"false" help:"enables essential actions on containers from the web interface."`
+	EnableShell      bool                `arg:"--enable-shell,env:DOZZLE_ENABLE_SHELL" default:"false" help:"enables shell access to containers from the web interface."`
 	FilterStrings    []string            `arg:"env:DOZZLE_FILTER,--filter,separate" help:"filters docker containers using Docker syntax."`
 	Filter           map[string][]string `arg:"-"`
 	RemoteHost       []string            `arg:"env:DOZZLE_REMOTE_HOST,--remote-host,separate" help:"list of hosts to connect remotely"`
diff --git a/internal/web/index.go b/internal/web/index.go
index 77ef2f10..e8a9cd93 100644
--- a/internal/web/index.go
+++ b/internal/web/index.go
@@ -60,6 +60,7 @@ func (h *handler) executeTemplate(w http.ResponseWriter, req *http.Request) {
 		config["hostname"] = h.config.Hostname
 		config["hosts"] = hosts
 		config["enableActions"] = h.config.EnableActions
+		config["enableShell"] = h.config.EnableShell
 	}
 
 	if user != nil {
diff --git a/internal/web/routes.go b/internal/web/routes.go
index 8ce7b83c..3df251ee 100644
--- a/internal/web/routes.go
+++ b/internal/web/routes.go
@@ -35,6 +35,7 @@ type Config struct {
 	Dev           bool
 	Authorization Authorization
 	EnableActions bool
+	EnableShell   bool
 	Labels        container.ContainerLabels
 }
 
@@ -107,8 +108,6 @@ func createRouter(h *handler) *chi.Mux {
 				r.Get("/hosts/{host}/containers/{id}/logs/stream", h.streamContainerLogs)
 				r.Get("/hosts/{host}/logs/stream", h.streamHostLogs)
 				r.Get("/hosts/{host}/containers/{id}/logs", h.fetchLogsBetweenDates)
-				r.Get("/hosts/{host}/containers/{id}/attach", h.attach)
-				r.Get("/hosts/{host}/containers/{id}/exec", h.exec)
 				r.Get("/hosts/{host}/logs/mergedStream/{ids}", h.streamLogsMerged)
 				r.Get("/containers/{hostIds}/download", h.downloadLogs) // formatted as host:container,host:container
 				r.Get("/stacks/{stack}/logs/stream", h.streamStackLogs)
@@ -118,6 +117,10 @@ func createRouter(h *handler) *chi.Mux {
 				if h.config.EnableActions {
 					r.Post("/hosts/{host}/containers/{id}/actions/{action}", h.containerActions)
 				}
+				if h.config.EnableShell {
+					r.Get("/hosts/{host}/containers/{id}/attach", h.attach)
+					r.Get("/hosts/{host}/containers/{id}/exec", h.exec)
+				}
 				r.Get("/releases", h.releases)
 				r.Get("/profile/avatar", h.avatar)
 				r.Patch("/profile", h.updateProfile)
diff --git a/main.go b/main.go
index a77a18b3..5f774f35 100644
--- a/main.go
+++ b/main.go
@@ -191,6 +191,7 @@ func createServer(args cli.Args, hostService web.HostService) *http.Server {
 			TTL:        authTTL,
 		},
 		EnableActions: args.EnableActions,
+		EnableShell:   args.EnableShell,
 		Labels:        args.Filter,
 	}