diff --git a/shell/check_images.sh b/shell/check_images.sh
new file mode 100755
index 0000000..f12a877
--- /dev/null
+++ b/shell/check_images.sh
@@ -0,0 +1,487 @@
+#!/usr/bin/env bash
+#
+# check_images.sh — 检查 deploy.stack 常用 Docker 镜像的最新版本
+#
+# 数据源：
+#   - Docker Hub  v2 API:  https://hub.docker.com/v2/repositories/<ns>/<repo>/tags/
+#   - 通用 registry v2:    https://<host>/v2/<repo>/tags/list
+#
+# 用法：
+#   ./check_images.sh                      # 全量
+#   ./check_images.sh gitea nginx postgres # 名称包含关键字的镜像
+#   ./check_images.sh -j 20                # 并发数（默认 10）
+#   ./check_images.sh --json               # JSON 输出
+#   ./check_images.sh --pre                # 含 rc/beta/dev 等预发布
+#   ./check_images.sh --outdated           # 只显示可升级的
+#   ./check_images.sh --proxy              # source ./proxy.sh 后开启代理
+#   ./check_images.sh --timeout 20         # 单镜像超时（秒）
+#   ./check_images.sh -h | --help          # 帮助
+#
+# 退出码：
+#   0 = 全部最新或仅有 unknown；1 = 存在可升级；2 = 致命错误
+#
+# 注意：
+#   - 私有仓库（hub.tp229.com:3500、hub.wesais.cn、hub.6t7.net 等）大多不开
+#     匿名 tags API，这些会标 "unknown"，不会算作失败
+#   - Docker Hub 限流：匿名 100 req/IP/6h；并发 > 20 易触发 429
+#   - tag 命名差异大（日期 tag it-tools:20241022、变体 tag mysql:8.4-alpine
+#     等），本脚本按 "last_updated 倒序 + 非预发布" 选 "最新"，不做语义版本
+#     比较，仅字符串对比
+#   - 默认排除预发布标记：-rc / -beta / -alpha / -dev / -pre / -edge /
+#     nightly / experimental / testing；edge 频道镜像（netdata/netdata:edge-0）
+#     在 --pre 模式下可见
+#
+# 扩展：
+#   如需新增/修改镜像，编辑下方 IMAGES 数组即可。
+#
+# 依赖：curl、python3（仅用于 JSON 解析）
+
+set -euo pipefail
+
+# ===================== 默认配置 =====================
+PARALLEL=10
+JSON_MODE=0
+INCLUDE_PRE=0
+ONLY_OUTDATED=0
+USE_PROXY=0
+TIMEOUT=15
+declare -a FILTERS=()
+
+# 镜像清单：image|current_tag|note
+#   - current_tag 写 "-" 表示只查最新不比较；latest 也算"已最新"
+#   - note 仅展示用
+IMAGES=(
+    # ---- 自托管应用 ----
+    "vaultwarden/server|1.36.0-alpine|"
+    "xhofe/alist|v3.32.0-ffmpeg|带 ffmpeg 变体"
+    "adminer|5.4.2|"
+    "anqicms/anqicms|latest|"
+    "mouday/domain-admin|v1.6.78|"
+    "pubuzhixing/drawnix|v0.4.1|"
+    "sigoden/dufs|v0.46.0|"
+    "pawelmalak/flame|multiarch2.3.1|多架构"
+    "gitea/gitea|1.27.3-rootless|rootless 变体"
+    "binwiederhier/ntfy|v2.24|"
+    "joplin/server|3.6.1|"
+    "neosmemo/memos|0.30.0|"
+    "n8nio/n8n|2.3.6|"
+    "redf0x1/camofox-browser|2.4.7|"
+    "nextcloud/all-in-one|latest|"
+    "owncloud/ocis|latest|"
+    "wg-easy/wg-easy|15.2.2|"
+
+    # ---- 数据库 ----
+    "redis|8.4.0-alpine|alpine 变体"
+    "postgres|18.4|"
+    "mysql|8.4|LTS"
+    "percona|8.0.35-27|"
+    "mongo|5.0|"
+    "couchdb|3.5|"
+    "valkey/valkey|9.0.0|"
+    "quay.io/coreos/etcd|v3.5.0|"
+
+    # ---- 监控 ----
+    "grafana/grafana|13.0.2|"
+    "grafana/loki|3.6.2|"
+    "victoriametrics/victoria-metrics|v1.126.0|"
+    "flashcatcloud/nightingale|9.0.0|"
+    "flashcatcloud/categraf|v0.4.15|"
+    "netdata/netdata|edge-0|edge 频道"
+
+    # ---- 反代/网关 ----
+    "haproxy|3.3.0|"
+    "caddy|2.10.0|"
+    "traefik|3.5.0|"
+    "portainer/portainer-ce|2.27.4|"
+    "portainer/agent|2.27.4|"
+
+    # ---- 私有仓库（多返回 unknown）----
+    "hub.tp229.com:3500/registry|3.0|私有"
+    "hub.tp229.com:3500/cnphpbb/registry-ui|latest|私有"
+    "hub.6t7.net/cnphpbb/it-tools|20241022|日期 tag"
+    "hub.wesais.cn/cnphpbb/mynat|v250603|日期 tag"
+    "hub.tp229.com:3500/ansible-alpine|py3.13-rootless|私有"
+    "hub.tp229.com:3500/gitea/gitea|1.27.3-rootless|私有镜像示例"
+)
+
+# ===================== 参数解析 =====================
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        -j|--parallel) PARALLEL="$2"; shift 2 ;;
+        --json)        JSON_MODE=1; shift ;;
+        --pre)         INCLUDE_PRE=1; shift ;;
+        --outdated)    ONLY_OUTDATED=1; shift ;;
+        --proxy)       USE_PROXY=1; shift ;;
+        --timeout)     TIMEOUT="$2"; shift 2 ;;
+        -h|--help)
+            sed -n '2,30p' "$0"
+            exit 0
+            ;;
+        -*)
+            echo "未知选项: $1" >&2
+            echo "使用 -h 查看帮助" >&2
+            exit 2
+            ;;
+        *)
+            FILTERS+=("$1"); shift
+            ;;
+    esac
+done
+
+# ===================== 代理 =====================
+if [[ $USE_PROXY -eq 1 ]]; then
+    _proxy_sh="$(cd "$(dirname "$0")" && pwd)/proxy.sh"
+    if [[ -f "$_proxy_sh" ]]; then
+        # shellcheck disable=SC1090
+        source "$_proxy_sh"
+        proxy_on >/dev/null || true
+    else
+        echo "⚠️  未找到 proxy.sh（${_proxy_sh}），跳过代理" >&2
+    fi
+fi
+
+# ===================== 依赖检查 =====================
+for cmd in curl python3; do
+    if ! command -v "$cmd" >/dev/null 2>&1; then
+        echo "❌ 缺少依赖: $cmd" >&2
+        exit 2
+    fi
+done
+
+# ===================== 函数 =====================
+
+# 解析 registry 类型与 API URL，输出 "<api_type>|<url>"
+resolve_registry() {
+    local image="$1"
+    # 通用 v2 registry：含端口或知名前缀
+    if [[ "$image" == *":"*"/"* ]] || \
+       [[ "$image" == hub.* ]] || \
+       [[ "$image" == ghcr.io/* ]] || \
+       [[ "$image" == quay.io/* ]] || \
+       [[ "$image" == gcr.io/* ]]; then
+        local host_port="${image%%/*}"
+        local repo_path="${image#*/}"
+        echo "v2|https://${host_port}/v2/${repo_path}/tags/list"
+        return
+    fi
+    # Docker Hub
+    local ns repo
+    if [[ "$image" == */* ]]; then
+        ns="${image%%/*}"
+        repo="${image##*/}"
+    else
+        ns="library"
+        repo="$image"
+    fi
+    echo "dockerhub|https://hub.docker.com/v2/repositories/${ns}/${repo}/tags/?page_size=100&ordering=last_updated"
+}
+
+# python3 解析 JSON，从 stdin 读取
+# 输出 "TAG" 或 "ERR|reason"
+parse_latest() {
+    python3 - "$INCLUDE_PRE" <<'PYEOF'
+import json, sys, re
+
+include_pre = sys.argv[1] == "1"
+raw = sys.stdin.read()
+if not raw.strip():
+    print("ERR|empty response")
+    sys.exit(0)
+
+try:
+    data = json.loads(raw)
+except json.JSONDecodeError as e:
+    print(f"ERR|invalid json: {e}")
+    sys.exit(0)
+
+tags = []
+if isinstance(data, dict) and "results" in data:
+    for t in data["results"]:
+        if isinstance(t, dict):
+            tags.append((t.get("name", ""), t.get("last_updated", "") or ""))
+elif isinstance(data, dict) and "tags" in data:
+    for n in data.get("tags") or []:
+        tags.append((n, ""))
+else:
+    if isinstance(data, dict):
+        detail = data.get("detail") or data.get("message") or "unknown"
+    else:
+        detail = "unknown"
+    print(f"ERR|{detail}")
+    sys.exit(0)
+
+if not tags:
+    print("ERR|no tags")
+    sys.exit(0)
+
+def version_key(name):
+    """可排序的版本主键：v1.27.3 → (1,27,3)；无法识别 → (0,)"""
+    m = re.match(r"^v?(\d+(?:\.\d+)*)", name)
+    if not m:
+        return (0,)
+    return tuple(int(p) for p in m.group(1).split("."))
+
+# 主：版本降序；次：好变体优先；再次：last_updated 降序
+tags.sort(key=lambda x: (version_key(x[0]),
+                          1 if is_good_variant(x[0]) else 0,
+                          x[1], x[0]), reverse=True)
+
+# 按 . 或 - 切分 tag，任一段命中预发布关键词即视为预发布
+PRE_MARKERS = {
+    "rc", "beta", "alpha", "dev", "pre", "edge",
+    PRE_MARKERS = {"rc", "beta", "alpha", "dev", "pre", "edge",
+    "nightly", "experimental", "testing", "ea",
+}
+
+def is_pre_release(name: str) -> bool:
+    parts = re.split(r"[.\-]", name.lower())
+    # 去掉头尾数字：rc1→rc、19beta3→beta、2.0.0-rc.1→rc
+    parts = [re.sub(r"^\d+|\d+$", "", p) for p in parts]
+    return any(p in PRE_MARKERS for p in parts)
+
+# 版本型 tag 前缀：v可选，后接数字与点（如 2.10.0、v1.27.3-rootless、8.4.0-alpine）
+VERSION_PREFIX = re.compile(r"^v?\d+(?:\.\d+)*")
+def looks_like_version(name: str) -> bool:
+    return bool(VERSION_PREFIX.match(name))
+
+# 不适合作为 "最新推荐" 的后缀：Windows 变体 / Oracle Linux / x86_64 桌面 / 早期访问 / CentOS / 企业版 / builder
+BAD_VARIANTS = {
+    "nanoserver", "windowsservercore", "wincore",
+    "oraclelinux", "oracle",
+    "pc",                                # x86_64 桌面构建（服务器场景不需要）
+    "ea",                                # Early Access
+    "centos", "rockylinux", "alma",      # RHEL 系变体（服务器场景多不用）
+    "enterprise", "fips",                # 企业版 / FIPS（需要商业授权）
+    "builder",                           # 镜像构建阶段，不适合运行时
+}
+def is_good_variant(name: str) -> bool:
+    base = re.sub(r"^v?\d+(?:\.\d+)*", "", name.lower()).lstrip("-")
+    return not any(bad in base for bad in BAD_VARIANTS)
+
+# 三遍选择：版本型 > 非预发布非平台变体 > latest 回退
+fallback_latest = None
+seen = set()
+for name, _ in tags:
+    if not name or name in seen:
+        continue
+    seen.add(name)
+    if name.lower() == "latest":
+        fallback_latest = name
+        continue
+    if not include_pre and is_pre_release(name):
+        continue
+    if not looks_like_version(name):
+        continue
+    print(name)
+    sys.exit(0)
+
+# 第二遍：含日期/字母前缀但仍像版本（20241022、py3.13、multiarch2.3.1 等）
+for name, _ in tags:
+    if not name or name in seen:
+        continue
+    seen.add(name)
+    if name.lower() == "latest":
+        continue
+    if not include_pre and is_pre_release(name):
+        continue
+    print(name)
+    sys.exit(0)
+
+if fallback_latest:
+    print(fallback_latest)
+elif tags:
+    print(tags[0][0])
+PYEOF
+}
+
+# 检查单个镜像，stdout: IMAGE|CURRENT|LATEST|STATUS|NOTE
+check_one() {
+    local image="$1"
+    local current="$2"
+    local note="$3"
+
+    local api_info api_type url
+    api_info=$(resolve_registry "$image")
+    api_type="${api_info%%|*}"
+    url="${api_info#*|}"
+
+    local body
+    if ! body=$(curl -sS --max-time "$TIMEOUT" "$url" 2>/dev/null); then
+        printf '%s|%s|%s|unknown|%s\n' "$image" "$current" "(unreachable)" "$note"
+        return 0
+    fi
+
+    if [[ -z "$body" ]]; then
+        printf '%s|%s|%s|unknown|%s\n' "$image" "$current" "(unreachable)" "$note"
+        return 0
+    fi
+
+    local parsed latest
+    parsed=$(printf '%s' "$body" | parse_latest) || true
+    if [[ "$parsed" == ERR* ]]; then
+        printf '%s|%s|%s|unknown|%s\n' "$image" "$current" "$parsed" "$note"
+        return 0
+    fi
+    latest="$parsed"
+
+    local status
+    # 同版本（忽略后缀）视为已最新：1.36.0 vs 1.36.0-alpine、3.6.1 vs 3.6.1-bookworm
+    local cur_base lat_base
+    cur_base=$(echo "$current"  | sed -E 's/^v?([0-9]+(\.[0-9]+)*).*/\1/')
+    lat_base=$(echo "$latest"   | sed -E 's/^v?([0-9]+(\.[0-9]+)*).*/\1/')
+    if [[ "$current" == "-" ]] || [[ "$current" == "latest" ]] \
+       || [[ "$current" == "$latest" ]] || [[ "$cur_base" == "$lat_base" && -n "$cur_base" ]]; then
+        status="up-to-date"
+    else
+        status="outdated"
+    fi
+
+    printf '%s|%s|%s|%s|%s\n' "$image" "$current" "$latest" "$status" "$note"
+}
+
+# 表格输出
+display_table() {
+    local -a rows=("$@")
+    local total=${#rows[@]}
+    local up_to_date=0 outdated=0 unknown=0
+
+    for row in "${rows[@]}"; do
+        IFS='|' read -r _ _ _ status _ <<< "$row"
+        case "$status" in
+            up-to-date) up_to_date=$((up_to_date+1)) ;;
+            outdated)   outdated=$((outdated+1)) ;;
+            unknown)    unknown=$((unknown+1)) ;;
+        esac
+    done
+
+    printf '\033[36m┌──────────────────────────────────────────────────────────────────────────────────────────────┐\033[0m\n'
+    printf '\033[36m│\033[0m  \033[1;36m%-46s %-14s %-14s %-14s\033[0m  \033[36m│\033[0m\n' "IMAGE" "CURRENT" "LATEST" "STATUS"
+    printf '\033[36m├──────────────────────────────────────────────────────────────────────────────────────────────┤\033[0m\n'
+
+    for row in "${rows[@]}"; do
+        IFS='|' read -r img cur latest status _ <<< "$row"
+        local status_disp latest_disp
+        case "$status" in
+            up-to-date)
+                status_disp=$(printf '\033[32m✓ up-to-date\033[0m')
+                latest_disp="$latest"
+                ;;
+            outdated)
+                status_disp=$(printf '\033[33m↑ outdated\033[0m')
+                latest_disp=$(printf '\033[36m%s\033[0m' "$latest")
+                ;;
+            unknown)
+                status_disp=$(printf '\033[31m✗ unknown\033[0m')
+                latest_disp=$(printf '\033[2m%s\033[0m' "$latest")
+                ;;
+            *)
+                status_disp="$status"
+                latest_disp="$latest"
+                ;;
+        esac
+        local img_short="$img"
+        if [[ ${#img_short} -gt 46 ]]; then
+            img_short="${img_short:0:43}..."
+        fi
+        printf '\033[36m│\033[0m  %-46s %-14s %-14s %-30b  \033[36m│\033[0m\n' \
+            "$img_short" "$cur" "$latest_disp" "$status_disp"
+    done
+
+    printf '\033[36m└──────────────────────────────────────────────────────────────────────────────────────────────┘\033[0m\n'
+
+    echo
+    printf '\033[1;36m📊 汇总:\033[0m 总计 %d | \033[32m✓ %d\033[0m | \033[33m↑ %d\033[0m | \033[31m? %d\033[0m\n' \
+        "$total" "$up_to_date" "$outdated" "$unknown"
+}
+
+# JSON 输出
+display_json() {
+    local -a rows=("$@")
+    echo "["
+    local first=1
+    for row in "${rows[@]}"; do
+        IFS='|' read -r img cur latest status note <<< "$row"
+        if [[ $first -eq 1 ]]; then
+            printf '  {"image":"%s","current":"%s","latest":"%s","status":"%s","note":"%s"}' \
+                "$img" "$cur" "$latest" "$status" "$note"
+            first=0
+        else
+            printf ',\n  {"image":"%s","current":"%s","latest":"%s","status":"%s","note":"%s"}' \
+                "$img" "$cur" "$latest" "$status" "$note"
+        fi
+    done
+    echo
+    echo "]"
+}
+
+# ===================== 主逻辑 =====================
+
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+declare -a rows=()
+active=0
+idx=0
+
+for entry in "${IMAGES[@]}"; do
+    IFS='|' read -r image current note <<< "$entry"
+    [[ -z "$image" ]] && continue
+
+    if [[ ${#FILTERS[@]} -gt 0 ]]; then
+        matched=0
+        for f in "${FILTERS[@]}"; do
+            [[ "$image" == *"$f"* ]] && matched=1
+        done
+        [[ $matched -eq 0 ]] && continue
+    fi
+
+    (
+        check_one "$image" "$current" "$note" > "$tmpdir/$idx.out" 2>&1
+    ) &
+
+    active=$((active+1))
+    idx=$((idx+1))
+
+    if [[ $active -ge $PARALLEL ]]; then
+        wait -n 2>/dev/null || true
+        active=$((active-1))
+    fi
+done
+
+wait
+
+# 收集结果
+for ((i=0; i<idx; i++)); do
+    if [[ -f "$tmpdir/$i.out" ]]; then
+        rows+=("$(cat "$tmpdir/$i.out")")
+    fi
+done
+
+# 仅显示过期
+if [[ $ONLY_OUTDATED -eq 1 ]]; then
+    declare -a filtered=()
+    for row in "${rows[@]}"; do
+        IFS='|' read -r _ _ _ status _ <<< "$row"
+        [[ "$status" == "outdated" ]] && filtered+=("$row")
+    done
+    rows=("${filtered[@]}")
+fi
+
+# 输出
+if [[ $JSON_MODE -eq 1 ]]; then
+    display_json "${rows[@]}"
+else
+    display_table "${rows[@]}"
+fi
+
+# 退出码
+outdated_count=0
+for row in "${rows[@]}"; do
+    IFS='|' read -r _ _ _ status _ <<< "$row"
+    [[ "$status" == "outdated" ]] && outdated_count=$((outdated_count+1))
+done
+
+if [[ $outdated_count -gt 0 ]]; then
+    exit 1
+fi
+exit 0