diff --git a/Dockerfile b/Dockerfile
index 8c0b9f8e..fff28d23 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.22.2 AS builder
+FROM golang:1.23 AS builder
 ARG http_proxy=
 ARG https_proxy=
 ARG HTTP_PROXY=
@@ -35,9 +35,16 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY --from=builder /out/sub2api-cn-relay-manager /usr/local/bin/sub2api-cn-relay-manager
-ENV SUB2API_CRM_LISTEN_ADDR=:8080
-ENV SUB2API_CRM_SQLITE_DSN=file:/data/sub2api-cn-relay-manager.db?_foreign_keys=on&_busy_timeout=5000
+
+# Required: Admin API token for administrative endpoints
+# Must be provided at runtime, container will fail to start without it
 ENV SUB2API_CRM_ADMIN_TOKEN=
+
+# Optional: Listen address (defaults to :8080)
+ENV SUB2API_CRM_LISTEN_ADDR=:8080
+
+# Optional: SQLite DSN (defaults to /data/sub2api-cn-relay-manager.db)
+ENV SUB2API_CRM_SQLITE_DSN=file:/data/sub2api-cn-relay-manager.db?_foreign_keys=on&_busy_timeout=5000
 VOLUME ["/data"]
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/sub2api-cn-relay-manager"]