diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..2f52577e
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,22 @@
+.git
+.gitignore
+.worktrees
+.agents
+.claude
+.DS_Store
+.env
+.env.*
+**/.env
+**/.env.*
+pg_data
+tmp
+.install-logs
+.pytest_cache
+**/.pytest_cache
+**/__pycache__
+**/*.pyc
+frontend/node_modules
+frontend/dist
+backend/.coverage
+backend/.pytest_cache
+nginx/certs
diff --git a/docker-compose.yaml b/docker-compose.yaml
index e5d43329..407152e1 100755
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -10,8 +10,6 @@ services:
     volumes:
       # 持久化数据到 Linux 本地，防止重启丢失
       - ./pg_data:/var/lib/postgresql/data
-    ports:
-      - "5432:5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ctms_user -d ctms_db"]
       interval: 5s
@@ -26,8 +24,6 @@ services:
       dockerfile: Dockerfile
     container_name: ctms_backend
     restart: always
-    ports:
-      - "8000:8000"
     environment:
       DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
     depends_on:
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 37ff0e79..4d23ba10 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -42,6 +42,12 @@ http {
             add_header Cache-Control "public, max-age=86400" always;
         }
 
+        location ~* (^|/)(\.git|\.env($|[./_-])|wp-config\.php|config\.php|database\.yml|backup($|[._/-])) {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location /api/ {
             proxy_pass http://backend;
             proxy_set_header Host $host;