将构建镜像源切换为阿里云并修复 apt 证书引导失败

默认 DEBIAN/ALPINE 源改为 mirrors.aliyun.com，compose 支持通过环境变量覆盖；构建时先装 ca-certificates，避免 slim 镜像换源后 HTTPS 校验失败。

deploy/docker/backend-dev.Dockerfile

@@ -1,7 +1,8 @@
 # 快手轻量开发镜像：只保留 Node 运行时和基础工具。
 FROM docker.m.daocloud.io/library/node:22-bookworm
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg DEBIAN_MIRROR=mirrors.cloud.aliyuncs.com
+ARG DEBIAN_MIRROR=mirrors.aliyun.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -10,13 +11,17 @@ ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
 
+# bookworm 基础镜像可能尚无 ca-certificates；国内源常跳 HTTPS，需先跳过校验装证书
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
+       ca-certificates \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates tzdata \
+       curl tzdata \
   && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
   && echo ${TZ} > /etc/timezone
 

deploy/docker/backend.Dockerfile

@@ -1,7 +1,8 @@
 # 快手轻量后端镜像
 FROM docker.m.daocloud.io/library/node:22-bookworm AS builder
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg DEBIAN_MIRROR=mirrors.cloud.aliyuncs.com
+ARG DEBIAN_MIRROR=mirrors.aliyun.com
 ARG NPM_REGISTRY=https://registry.npmmirror.com
 
 ENV DEBIAN_FRONTEND=noninteractive
@@ -9,13 +10,17 @@ ENV NPM_CONFIG_REGISTRY=${NPM_REGISTRY}
 
 WORKDIR /app
 
+# bookworm 基础镜像可能尚无 ca-certificates；国内源常跳 HTTPS，需先跳过校验装证书
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
+       ca-certificates \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates tzdata
+       curl tzdata
 
 COPY apps/backend/package.json apps/backend/package-lock.json ./
 RUN --mount=type=cache,target=/root/.npm npm ci
@@ -26,7 +31,7 @@ RUN npm run build \
 
 FROM docker.m.daocloud.io/library/node:22-bookworm-slim AS runtime
 
-ARG DEBIAN_MIRROR=mirrors.cloud.tencent.com
+ARG DEBIAN_MIRROR=mirrors.aliyun.com
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=Asia/Shanghai
@@ -38,9 +43,12 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \
   && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false update \
+  && apt-get -o Acquire::https::Verify-Peer=false -o Acquire::https::Verify-Host=false install -y --no-install-recommends \
+       ca-certificates \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
-       curl ca-certificates tzdata \
+       curl tzdata \
   && ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime \
   && echo ${TZ} > /etc/timezone \
   && apt-get clean \

deploy/docker/frontend.Dockerfile

@@ -16,7 +16,8 @@ RUN npm run build
 
 FROM docker.m.daocloud.io/library/caddy:2-alpine
 
-ARG ALPINE_MIRROR=mirrors.cloud.tencent.com
+# 阿里云公共源（全国可达）；也可构建时覆盖：--build-arg ALPINE_MIRROR=mirrors.cloud.aliyuncs.com
+ARG ALPINE_MIRROR=mirrors.aliyun.com
 
 ENV TZ=Asia/Shanghai