diff --git a/deploy/Dockerfile.frontend b/deploy/Dockerfile.frontend
index 4fecb13..9557657 100644
--- a/deploy/Dockerfile.frontend
+++ b/deploy/Dockerfile.frontend
@@ -7,7 +7,8 @@ COPY frontend/ ./
 RUN npm run build
 
 FROM nginx:1.27-alpine
+# 注意：容器内 nginx listen 改为 8000（避免占用宿主 80；1024+ 无 root 限制）
 COPY deploy/nginx/frontend.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/frontend/dist /usr/share/nginx/html
 
-EXPOSE 80
+EXPOSE 8000
diff --git a/deploy/nginx/frontend.conf b/deploy/nginx/frontend.conf
index 0aa1f51..080b099 100644
--- a/deploy/nginx/frontend.conf
+++ b/deploy/nginx/frontend.conf
@@ -3,7 +3,7 @@ upstream gemold_backend_upstream {
 }
 
 server {
-    listen 80;
+    listen 8000;
     server_name _;
 
     root /usr/share/nginx/html;
diff --git a/docker-compose.yml b/docker-compose.yml
index 73e3f98..e4ee917 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -61,8 +61,8 @@ services:
     image: gemold-frontend:latest
     container_name: gemold_frontend
     ports:
-      # 浏览器入口端口（默认 10003；容器内 nginx 仍监听 80，反代到 backend 8000）
-      - "${FRONTEND_PORT:-10003}:80"
+      # 浏览器入口端口（默认 10003）；容器内 nginx 监听 8000 反代到 backend 8000
+      - "${FRONTEND_PORT:-10003}:8000"
     depends_on:
       - backend
     restart: unless-stopped