diff --git a/.gitea/workflows/release-image.yml b/.gitea/workflows/release-image.yml
index 129e5fc..4cbea97 100644
--- a/.gitea/workflows/release-image.yml
+++ b/.gitea/workflows/release-image.yml
@@ -101,25 +101,27 @@ jobs:
           echo "ACR 用户: $ACR_USER (密码 ${#ACR_PASS} 位)"
           printf '%s' "$ACR_PASS" | docker login "$REGISTRY" -u "$ACR_USER" --password-stdin
 
+      - name: buildx 多架构构建并推送
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
       - name: buildx 多架构构建并推送
         env:
           TAGS: ${{ steps.meta.outputs.tags }}
         run: |
-          # docker-container 驱动才支持多平台；mirror 注入 buildkitd 配置
-          # （docker-container 是独立 BuildKit，不读 daemon.json）
-          printf '[registry."docker.io"]\nmirrors = ["docker.m.daocloud.io", "docker.1ms.run"]\n' \
-            > /tmp/buildkitd.toml
-          docker buildx rm ci >/dev/null 2>&1 || true
-          # --config 是全版本兼容参数；不要吞错误，create 失败要立即暴露
-          docker buildx create --name ci --driver docker-container --config /tmp/buildkitd.toml
-          docker buildx use ci
+          # docker-container 驱动才支持多平台。基础镜像/APK/NPM 全部走国内源：
+          # runner 侧网络对 docker.io 存在 DNS 污染（证书误配 facebook 域），不可直连
           ARGS=""
           for t in $TAGS; do ARGS="$ARGS -t $t"; done
           # provenance/sbom 必须关：阿里云 ACR 不识别 OCI empty manifest（attestation）
           docker buildx build \
+            --builder multiarch \
             --platform linux/amd64,linux/arm64 \
             --provenance=false --sbom=false \
+            --build-arg NODE_IMAGE=registry.cn-hangzhou.aliyuncs.com/skymirror/node:20-alpine \
+            --build-arg GO_IMAGE=registry.cn-hangzhou.aliyuncs.com/skymirror/golang:1.27.1-alpine \
+            --build-arg RUNTIME_IMAGE=registry.cn-hangzhou.aliyuncs.com/skymirror/alpine:3.20 \
             --build-arg NPM_REGISTRY=https://registry.npmmirror.com \
+            --build-arg APK_MIRROR=https://mirrors.aliyun.com \
             --push \
             -f deploy/Dockerfile \
             $ARGS \
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index af18060..6e113c2 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -2,9 +2,14 @@
 # 1) node:20-alpine 构建 Vue 前端产物（web/dist）
 # 2) golang:1.27.1-alpine 编译 server（go:embed 前端产物，缓存指向 /tmp 避免写权限问题）
 # 3) 最小运行时镜像：server 二进制 + web/dist 静态产物
+# 基础镜像可通过 build-arg 覆盖：CI/受限网络下指向 ACR 命名空间镜像
+# （--build-arg NODE_IMAGE=… GO_IMAGE=… RUNTIME_IMAGE=… APK_MIRROR=mirrors.aliyun.com）
+ARG NODE_IMAGE=node:20-alpine
+ARG GO_IMAGE=golang:1.27.1-alpine
+ARG RUNTIME_IMAGE=alpine:3.20
 # NPM_REGISTRY：CI/受限网络下注入 npm 镜像源（默认官方源）
 ARG NPM_REGISTRY=https://registry.npmjs.org
-FROM node:20-alpine AS frontend
+FROM ${NODE_IMAGE} AS frontend
 ARG NPM_REGISTRY
 WORKDIR /build
 RUN npm config set registry "$NPM_REGISTRY"
@@ -13,7 +18,7 @@ RUN npm ci || npm install
 COPY web/ ./
 RUN npm run build
 
-FROM golang:1.27.1-alpine AS backend
+FROM ${GO_IMAGE} AS backend
 WORKDIR /build
 # GOPROXY：默认走 goproxy.cn（proxy.golang.org 的 GCS 后端在本环境网络下 EOF/超时），direct 兜底
 ENV CGO_ENABLED=0 GOSUMDB=off GOPROXY=https://goproxy.cn,direct GOCACHE=/tmp/.gocache GOMODCACHE=/tmp/.gomodcache
@@ -34,9 +39,11 @@ RUN if [ -f web-embed/index.html ]; then \
  && rm -rf web-embed frontend-dist
 RUN go build -trimpath -ldflags "-s -w" -o /out/server ./cmd/server
 
-FROM alpine:3.20
-# curl 供容器健康检查使用
-RUN apk add --no-cache ca-certificates tzdata curl && adduser -D -u 10001 fcb
+FROM ${RUNTIME_IMAGE}
+# APK_MIRROR：受限网络下注入 alpine 镜像源（空=默认源）
+ARG APK_MIRROR=""
+RUN if [ -n "$APK_MIRROR" ]; then sed -i "s|https://dl-cdn.alpinelinux.org|$APK_MIRROR|g" /etc/apk/repositories; fi \
+ && apk add --no-cache ca-certificates tzdata curl && adduser -D -u 10001 fcb
 WORKDIR /app
 COPY --from=backend /out/server /app/server
 # dist 随镜像分发（服务端已 go:embed，磁盘副本供运维检查/替换）