diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
new file mode 100644
index 0000000..2d87da1
--- /dev/null
+++ b/docker-compose.prod.yml
@@ -0,0 +1,61 @@
+# 生产环境 Docker Compose 配置
+# 使用预构建镜像，适用于离线部署
+#
+# 部署步骤：
+# 1. docker network create api-network  (首次)
+# 2. gunzip -c droid2api.tar.gz | docker load
+# 3. docker compose -f docker-compose.prod.yml up -d
+
+services:
+  droid2api:
+    image: droid2api:latest        # 使用预构建镜像（非 build）
+    container_name: droid2api
+    ports:
+      - "3001:3000"
+    environment:
+      # 认证配置（按优先级选择其一）：
+      - FACTORY_API_KEY=${FACTORY_API_KEY}
+      - DROID_REFRESH_KEY=${DROID_REFRESH_KEY}
+      # 阿里云日志服务配置
+      - ALIYUN_ACCESS_KEY_ID=${ALIYUN_ACCESS_KEY_ID}
+      - ALIYUN_ACCESS_KEY_SECRET=${ALIYUN_ACCESS_KEY_SECRET}
+      - ALIYUN_SLS_ENDPOINT=${ALIYUN_SLS_ENDPOINT}
+      - ALIYUN_SLS_PROJECT=${ALIYUN_SLS_PROJECT}
+      - ALIYUN_SLS_LOGSTORE=${ALIYUN_SLS_LOGSTORE}
+      # API 认证中间件（new-api 接入时启用）
+      - AUTH_ENABLED=${AUTH_ENABLED:-false}
+      - API_KEYS=${API_KEYS}
+    volumes:
+      - ./data:/app/data
+      - ./accounts.json:/app/accounts.json:ro
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    networks:
+      - api-network
+
+  # Cloudflare Tunnel (可选)
+  # 启用方式: docker compose -f docker-compose.prod.yml --profile tunnel up -d
+  tunnel:
+    image: cloudflare/cloudflared:latest
+    container_name: droid2api_tunnel
+    restart: unless-stopped
+    command: tunnel run
+    environment:
+      - TUNNEL_TOKEN=${TUNNEL_TOKEN}
+    depends_on:
+      - droid2api
+    profiles:
+      - tunnel
+    networks:
+      - api-network
+
+# 共享网络 - 与 new-api 等服务互通
+# 首次使用: docker network create api-network
+networks:
+  api-network:
+    external: true