diff --git a/docs/04-deployment.md b/docs/04-deployment.md
index 5ba67689..19cf7b3f 100644
--- a/docs/04-deployment.md
+++ b/docs/04-deployment.md
@@ -50,12 +50,15 @@ docker build -t sanguo_vnpy:with-scripts -f docker/Dockerfile .
 ```bash
 docker run -d --name sanguo_vnpy \
   --restart unless-stopped \
-  -p 8888:8888 -p 8088:8088 -p 8000:8000 -p 2222:22 \
+  --privileged \
+  -p 2222:22 -p 8000:8000 -p 8088:8088 -p 8888:8888 \
   -v /volume1/stock/sanguo_vnpy/bt-service:/app/scripts/backtest_service:ro \
   -v /volume1/stock/sanguo_vnpy/entrypoint.sh:/app/entrypoint.sh:ro \
   sanguo_vnpy:with-scripts
 ```
 
+> ⚠️ `--privileged` 是必须的：群晖 NAS 内核 3.10 不支持 seccomp，SSH 服务（dropbear）需要特权模式运行。详见 [06-nas-infrastructure.md](06-nas-infrastructure.md) Q5。
+
 ### 3.3 验证部署
 
 ```bash