diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 6aaf1cb7c93..e459a2dd26e 100755
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -201,8 +201,16 @@ echo "Allowed Origins: $(get_cmd_value "--allowed_origins=" $command_args)"
 echo "Config Path: $(if [ -z "$(get_cmd_value "--config_path=" $command_args)" ]; then echo "NULL"; else echo "$(get_cmd_value "--config_path=" $command_args)"; fi)"
 echo "Encryption: $(get_boolean_str $(is_in_cmd "--encrypt_enable" $command_args))"
 echo "Cluster: $(get_boolean_str $(is_in_cmd "--cluster" $command_args))"
+echo "CF Zero Trust Token: $(get_cmd_value "--cf_zero_trust_token=" $command_args)"
 echo "============================================"
 
 command="node index.js $command_args"
 
+# 根据环境变量决定是否启动 cloudflared
+if [ "$ENABLE_CLOUDFLARED" = "true" ]; then
+  echo "Starting Cloudflared Tunnel"
+  echo "============================================"
+  nohup /usr/local/bin/cloudflared service install $CF_ZERO_TRUST_TOKEN &
+  echo "============================================"
+fi
 exec $command
diff --git a/dockerfile b/dockerfile
index 7c90a0d7192..68f60e60cc9 100644
--- a/dockerfile
+++ b/dockerfile
@@ -10,7 +10,10 @@ RUN node apps/core/download-latest-admin-assets.js
 
 FROM node:20-alpine
 
-RUN apk add zip unzip mongodb-tools bash fish rsync jq curl --no-cache
+RUN apk add zip unzip mongodb-tools bash fish rsync jq curl openrc --no-cache
+
+RUN curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared \
+    && chmod +x /usr/local/bin/cloudflared
 
 WORKDIR /app
 COPY --from=builder /app/out .