diff --git a/docker-compose.yml b/docker-compose.yml
index e9242e7..18f53e3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -26,6 +26,11 @@ services:
       - MAIL_ROUNDCUBE_URL=${MAIL_ROUNDCUBE_URL:-}
       # Uvicorn reload（生产环境保持 false）
       - UVICORN_RELOAD=${UVICORN_RELOAD:-false}
+    # 增加文件描述符限制，避免 "Too many open files" 错误
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health')"]
       interval: 30s
diff --git a/web/backend/services/login_service.py b/web/backend/services/login_service.py
index e57dac6..22e17e6 100644
--- a/web/backend/services/login_service.py
+++ b/web/backend/services/login_service.py
@@ -38,7 +38,9 @@ class LoginBatchRunner:
         self.created_by = created_by
         self.creator_permissions = creator_permissions
         self.max_proxy_retries = max_proxy_retries
-        self.max_login_retries = max_login_retries
+        # 限制最大重试次数，避免无限重试导致资源耗尽
+        # 0 表示使用默认值 10，其他值保持原样
+        self.max_login_retries = max_login_retries if max_login_retries > 0 else 10
         self.max_total_time = max_total_time
         self.proxy_config = proxy_config
         self.log_queue = log_queue