diff --git a/deploy/docker/Dockerfile.api b/deploy/docker/Dockerfile.api
index adbb34d..0e091df 100644
--- a/deploy/docker/Dockerfile.api
+++ b/deploy/docker/Dockerfile.api
@@ -2,7 +2,8 @@
 # build context: 仓库根目录
 # docker build -f deploy/docker/Dockerfile.api -t kefu-api:latest .
 #
-# 国内加速（默认开启）：Alpine 清华源 + goproxy.cn
+# 国内加速（默认开启）：Alpine 腾讯云源 + goproxy.cn
+# 注意：chai2010/webp 需要 CGO，必须装 gcc/musl-dev 且 CGO_ENABLED=1
 # 海外构建可覆盖：
 #   docker build --build-arg ALPINE_MIRROR=dl-cdn.alpinelinux.org \
 #     --build-arg GOPROXY=https://proxy.golang.org,direct ...
@@ -12,9 +13,10 @@ FROM golang:1.24-alpine AS builder
 ARG ALPINE_MIRROR=mirrors.cloud.tencent.com
 ARG GOPROXY=https://goproxy.cn,direct
 
-# 若 go.mod 要求更高版本，自动下载 toolchain
+# go.mod 若要求更高版本，自动下载 toolchain
 ENV GOTOOLCHAIN=auto
-ENV CGO_ENABLED=0
+# webp（chai2010）含 C 代码，关闭 CGO 会 undefined: webpEncode*
+ENV CGO_ENABLED=1
 ENV GOPROXY=${GOPROXY}
 ENV GOSUMDB=sum.golang.google.cn
 
@@ -22,7 +24,7 @@ RUN set -eux; \
     if [ -n "${ALPINE_MIRROR}" ]; then \
       sed -i "s#dl-cdn.alpinelinux.org#${ALPINE_MIRROR}#g" /etc/apk/repositories; \
     fi; \
-    apk add --no-cache git ca-certificates tzdata
+    apk add --no-cache git ca-certificates tzdata gcc musl-dev
 
 WORKDIR /src
 
@@ -31,12 +33,16 @@ COPY server/go.mod server/go.sum ./
 RUN go mod download
 
 COPY server/ ./
+# 静态链接，最终 alpine 镜像无需再装 libwebp / gcc
 RUN GOOS=linux GOARCH=amd64 \
-    go build -trimpath -ldflags="-s -w" -o /out/server ./cmd/main.go
+    go build -trimpath \
+      -ldflags="-s -w -linkmode external -extldflags '-static'" \
+      -o /out/server ./cmd/main.go
 
-# 种子程序（compose profile seed 使用）
 RUN GOOS=linux GOARCH=amd64 \
-    go build -trimpath -ldflags="-s -w" -o /out/seed ./cmd/seed
+    go build -trimpath \
+      -ldflags="-s -w -linkmode external -extldflags '-static'" \
+      -o /out/seed ./cmd/seed
 
 FROM alpine:3.21