diff --git a/.env b/.env
index af00964..b4a76fc 100644
--- a/.env
+++ b/.env
@@ -2,4 +2,8 @@
 # VITE_ARM_DEVICE_ID = 'aubo_arm'
 # 机械臂IP 192.168.1.109:50052
 
-VITE_SERVICE_PORT = 5175
\ No newline at end of file
+VITE_SERVICE_PORT=5175
+
+# /home/cmvr/zh/mkcert 目录中的证书文件名
+HTTPS_CERT_FILENAME=cert.pem
+HTTPS_KEY_FILENAME=key.pem
diff --git a/Dockerfile b/Dockerfile
index 1404d71..ec8110f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,38 +1,30 @@
-# ========== 阶段1：构建前端 ==========
+# syntax=docker/dockerfile:1
+
 FROM node:20-alpine AS builder
 
-RUN npm install -g pnpm
-
+RUN corepack enable
 WORKDIR /app
 
-# 先拷贝依赖文件，利用 Docker 缓存层
 COPY package.json pnpm-lock.yaml ./
-RUN pnpm install --frozen-lockfile
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile
 
-# 拷贝源码并构建
 COPY . .
 RUN pnpm run build
 
-# ========== 阶段2：生产运行 ==========
 FROM node:20-alpine AS runner
 
-RUN npm install -g pnpm
-
+RUN corepack enable
 WORKDIR /app
 
-# 只拷贝生产需要的文件
 COPY package.json pnpm-lock.yaml ./
-RUN pnpm install --frozen-lockfile --prod && pnpm store prune
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store \
+    pnpm install --frozen-lockfile --prod
 
-# 拷贝 Express 服务代码
 COPY server/ ./server/
-
-# 从构建阶段拷贝前端产物
 COPY --from=builder /app/dist ./dist
 
-EXPOSE 5175 5173
-
 ENV NODE_ENV=production
-ENV VITE_SERVICE_PORT=5175
+USER node
 
-CMD ["node", "server/index.js"]
\ No newline at end of file
+CMD ["node", "server/index.js"]
diff --git a/README.md b/README.md
index 1511959..e08ebf3 100644
--- a/README.md
+++ b/README.md
@@ -3,3 +3,22 @@
 This template should help get you started developing with Vue 3 in Vite. The template uses Vue 3 `<script setup>` SFCs, check out the [script setup docs](https://v3.vuejs.org/api/sfc-script-setup.html#sfc-script-setup) to learn more.
 
 Learn more about IDE Support for Vue in the [Vue Docs Scaling up Guide](https://vuejs.org/guide/scaling-up/tooling.html#ide-support).
+
+## Docker HTTPS 部署（Linux）
+
+服务直接通过 HTTPS 对外提供前端、API 和 WebSocket，不占用 443 端口。部署前修改 `.env`：
+
+```dotenv
+VITE_SERVICE_PORT=5175
+HTTPS_CERT_FILENAME=你的证书文件.pem
+HTTPS_KEY_FILENAME=你的私钥文件-key.pem
+```
+
+证书和私钥应位于 Linux 的 `/home/cmvr/zh/mkcert` 目录中，该目录会以只读方式挂载到容器。然后执行：
+
+```bash
+docker compose up -d --build
+docker compose logs -f app
+```
+
+访问地址为 `https://<Linux主机IP>:<VITE_SERVICE_PORT>`。请确保防火墙已放行该端口，并且证书包含实际访问时使用的域名或 IP。
diff --git a/docker-compose.yml b/docker-compose.yml
index 77f3b00..55c48d0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,11 +5,13 @@ services:
       dockerfile: Dockerfile
     container_name: inspection-host-computer
     ports:
-      - "5175:5175"          # 映射端口
+      - "${VITE_SERVICE_PORT:-5175}:${VITE_SERVICE_PORT:-5175}"
     environment:
-      - NODE_ENV=production
-      - VITE_SERVICE_PORT=5175            # 传给 Express 的环境变量
-    restart: unless-stopped  # 容器意外停止后自动重启
-    # 如果需要挂载日志或配置，可以加 volumes
-    # volumes:
-    #   - ./logs:/app/logs
\ No newline at end of file
+      NODE_ENV: production
+      VITE_SERVICE_PORT: "${VITE_SERVICE_PORT:-5175}"
+      HTTPS_ENABLED: "true"
+      HTTPS_CERT_FILE: "/certs/${HTTPS_CERT_FILENAME:-cert.pem}"
+      HTTPS_KEY_FILE: "/certs/${HTTPS_KEY_FILENAME:-key.pem}"
+    volumes:
+      - /home/cmvr/zh/mkcert:/certs:ro
+    restart: unless-stopped
diff --git a/server/index.js b/server/index.js
index cf9b0fc..bdbba16 100644
--- a/server/index.js
+++ b/server/index.js
@@ -2,6 +2,9 @@
 import express from 'express'
 import cors from 'cors'
 import path from 'path';
+import fs from 'fs';
+import http from 'http';
+import https from 'https';
 
 import 'dotenv/config';
 import {
@@ -493,7 +496,12 @@ app.post('/api/arm/torqueOn', async (req, res) => {
 })
 
 const isProd = process.env.NODE_ENV === 'production';
-const PORT = process.env.VITE_SERVICE_PORT || 3000;
+const PORT = Number(process.env.VITE_SERVICE_PORT || 3000);
+const httpsEnabled = process.env.HTTPS_ENABLED === 'true';
+
+if (!Number.isInteger(PORT) || PORT < 1 || PORT > 65535) {
+  throw new Error(`VITE_SERVICE_PORT 必须是 1-65535 之间的整数，当前值为: ${process.env.VITE_SERVICE_PORT}`);
+}
 
 // ============ 生产环境：托管 Vite 构建产物 ============
 if (isProd) {
@@ -514,8 +522,27 @@ if (isProd) {
 
 // ========== 启动 =========
 
-const httpServer = app.listen(PORT, () => {
-  console.log(`gRPC 桥接服务已启动: http://localhost:${PORT}`)
-})
+let httpServer;
+
+if (httpsEnabled) {
+  const certFile = process.env.HTTPS_CERT_FILE;
+  const keyFile = process.env.HTTPS_KEY_FILE;
+
+  if (!certFile || !keyFile) {
+    throw new Error('启用 HTTPS 时必须设置 HTTPS_CERT_FILE 和 HTTPS_KEY_FILE');
+  }
+
+  httpServer = https.createServer({
+    cert: fs.readFileSync(certFile),
+    key: fs.readFileSync(keyFile)
+  }, app);
+} else {
+  httpServer = http.createServer(app);
+}
 
 attachAudioWebSocket(httpServer)
+
+httpServer.listen(PORT, '0.0.0.0', () => {
+  const protocol = httpsEnabled ? 'https' : 'http';
+  console.log(`gRPC 桥接服务已启动: ${protocol}://0.0.0.0:${PORT}`)
+})