diff --git a/.dockerignore b/.dockerignore
index 95a8ae3..3cb48a6 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,7 +1,10 @@
-**/node_modules/
-**/dist
+node_modules
+.next
+out
+build
 .git
-npm-debug.log
-.coverage
-.coverage.*
-.env
+.env*.local
+README.md
+docker-compose.yml
+Dockerfile
+.dockerignore
\ No newline at end of file
diff --git a/.env b/.env
new file mode 100644
index 0000000..16c6687
--- /dev/null
+++ b/.env
@@ -0,0 +1,15 @@
+KEYCLOAK_CLIENT_ID=
+KEYCLOAK_CLIENT_SECRET=
+KEYCLOAK_ISSUER=
+NEXTAUTH_SECRET=
+NEXTAUTH_URL=
+
+# 为前端暴露的变量添加 NEXT_PUBLIC_ 前缀
+NEXT_PUBLIC_BACKEND_URL=
+NEXT_PUBLIC_MAP_URL=
+NEXT_PUBLIC_MAP_WORKSPACE=
+NEXT_PUBLIC_MAP_EXTENT=
+# NEXT_PUBLIC_MAP_AVAILABLE_LAYERS="junctions, pipes, reservoirs, scada"
+NEXT_PUBLIC_NETWORK_NAME=
+NEXT_PUBLIC_MAPBOX_TOKEN=
+NEXT_PUBLIC_TIANDITU_TOKEN=
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index d792d2a..d299ac4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM refinedev/node:18 AS base
+FROM refinedev/node:22 AS base
 
 FROM base AS deps
 
@@ -15,6 +15,16 @@ RUN \
 
 FROM base AS builder
 
+# 只定义 ARG 接收来自构建命令或 docker-compose.yaml 的参数
+# Next.js 在 build 时会自动读取同名的 ARG 作为环境变量
+ARG NEXT_PUBLIC_BACKEND_URL
+ARG NEXT_PUBLIC_MAP_URL
+ARG NEXT_PUBLIC_MAP_WORKSPACE
+ARG NEXT_PUBLIC_MAP_EXTENT
+ARG NEXT_PUBLIC_NETWORK_NAME
+ARG NEXT_PUBLIC_MAPBOX_TOKEN
+ARG NEXT_PUBLIC_TIANDITU_TOKEN
+
 COPY --from=deps /app/refine/node_modules ./node_modules
 
 COPY . .
@@ -23,7 +33,7 @@ RUN npm run build
 
 FROM base AS runner
 
-ENV NODE_ENV production
+ENV NODE_ENV=production
 
 COPY --from=builder /app/refine/public ./public
 
@@ -37,7 +47,7 @@ USER refine
 
 EXPOSE 3000
 
-ENV PORT 3000
-ENV HOSTNAME "0.0.0.0"
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
 
 CMD ["node", "server.js"]