diff --git a/deploy/base-images/go-runtime.Dockerfile b/deploy/base-images/go-runtime.Dockerfile
index b9b22a2..a58f4e4 100644
--- a/deploy/base-images/go-runtime.Dockerfile
+++ b/deploy/base-images/go-runtime.Dockerfile
@@ -1,16 +1,58 @@
+# =======================================================
+# XControl Go Runtime Base Image
+# - 用于所有静态编译的 Go 服务
+# - 可选安装 Go SDK（用于 build 阶段）
+# - 多架构安全（amd64/arm64 自动识别）
+# =======================================================
+
 FROM ubuntu:24.04
 
 LABEL maintainer="XControl" \
-      description="Slim Ubuntu runtime base for Go services with TLS certificates"
+      org.opencontainers.image.title="go-runtime" \
+      org.opencontainers.image.description="Slim Ubuntu runtime base for Go services with TLS certificates + optional Go SDK" \
+      org.opencontainers.image.licenses="Apache-2.0"
 
-ENV CGO_ENABLED=0
+# ---- Runtime 基础环境 ----
+ENV CGO_ENABLED=0 \
+    TZ=Etc/UTC
+
+ARG INSTALL_GO="false"
+ARG GO_VERSION="1.24.5"
 
 RUN set -eux; \
     apt-get update; \
     apt-get install -y --no-install-recommends \
-        ca-certificates; \
+        ca-certificates \
+        tzdata \
+        wget \
+        tar; \
     rm -rf /var/lib/apt/lists/*
 
+# =======================================================
+# 可选：安装 Go SDK（用于 make build 的情况）
+# =======================================================
+RUN if [ "$INSTALL_GO" = "true" ]; then \
+      set -eux; \
+      arch="$(uname -m)"; \
+      case "$arch" in \
+          x86_64|amd64) goarch="amd64" ;; \
+          aarch64|arm64) goarch="arm64" ;; \
+          *) echo "Unsupported arch: $arch"; exit 1 ;; \
+      esac; \
+      tarball="go${GO_VERSION}.linux-${goarch}.tar.gz"; \
+      url="https://go.dev/dl/${tarball}"; \
+      echo "Installing Go ${GO_VERSION} for ${goarch}"; \
+      wget -q "$url" -O "/tmp/go.tgz"; \
+      rm -rf /usr/local/go; \
+      tar -C /usr/local -xzf "/tmp/go.tgz"; \
+      rm /tmp/go.tgz; \
+      echo 'export PATH=$PATH:/usr/local/go/bin' > /etc/profile.d/go.sh; \
+    fi
+
+ENV PATH="${PATH}:/usr/local/go/bin"
+
+# ---- 应用目录 ----
 WORKDIR /app
 
+# ---- 默认 shell 入口（最终服务会覆盖 CMD） ----
 CMD ["/bin/sh"]
diff --git a/rag-server/Dockerfile b/rag-server/Dockerfile
index 5b1a957..3797ab7 100644
--- a/rag-server/Dockerfile
+++ b/rag-server/Dockerfile
@@ -2,35 +2,48 @@
 # Stage 1 — Builder
 # =======================================================
 ARG GO_RUNTIME_IMAGE
+ARG INSTALL_GO=true     # 为 builder 启用 Go SDK（go-runtime.Dockerfile 会处理）
 FROM ${GO_RUNTIME_IMAGE} AS builder
 
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends make ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
+# 在 builder 中启用 Go SDK
+ARG INSTALL_GO
+
 WORKDIR /src
 
-COPY . .
-RUN make build
+# 只安装 build 必需的工具（runtime 不会包含这些包）
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends make git ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
 
+# 拷贝整个 monorepo（推荐：未来可以只 COPY rag-server）
+COPY . .
+
+# 编译 Go 服务（你的 Makefile 必须生成 /out/rag-server）
+RUN make build && mkdir -p /out && cp rag-server /out/rag-server
 
 # =======================================================
 # Stage 2 — Runtime
 # =======================================================
 ARG GO_RUNTIME_IMAGE
+ARG INSTALL_GO=false     # runtime 不安装 Go SDK
 FROM ${GO_RUNTIME_IMAGE} AS runtime
 
-# ---- Install minimal dependencies for runtime ----------------
+WORKDIR /app
+
+# runtime 只需要 TLS certs（这些在 go-runtime 里已安装）
+# 如需额外依赖，可放到这里
 RUN apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /app
-
+# 拷贝构建产物
 COPY --from=builder /out/rag-server /usr/local/bin/rag-server
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+
 RUN chmod +x /usr/local/bin/entrypoint.sh
 
 VOLUME ["/etc/xcontrol/"]
 EXPOSE 8090
+
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
 CMD []