diff --git a/docker-compose.yml b/docker-compose.yml
index f813cc2..a118678 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -23,8 +23,10 @@ services:
     command: --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
     volumes:
       - mysql_data:/var/lib/mysql
-    ports:
-      - "33306:3306"  # 宿主机 33306 → 容器内 3306
+    # 不暴露端口到宿主机，backend 通过 Docker 内部网络连接
+    # 如需外部访问（Navicat），取消下面注释：
+    # ports:
+    #   - "33306:3306"
     healthcheck:
       test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
       interval: 10s