diff --git a/.memory/worklog.json b/.memory/worklog.json
index d88ebe2..a977958 100644
--- a/.memory/worklog.json
+++ b/.memory/worklog.json
@@ -230,6 +230,13 @@
       "message": "auto-save 2026-04-19 21:50 (~1)",
       "hash": "52b574f",
       "files_changed": 1
+    },
+    {
+      "ts": "2026-04-19T21:56:24+08:00",
+      "type": "commit",
+      "message": "auto-save 2026-04-19 21:56 (~1)",
+      "hash": "68c233d",
+      "files_changed": 1
     }
   ]
 }
diff --git a/orchestrator/src/incus.ts b/orchestrator/src/incus.ts
index bacc7b1..ba49fde 100644
--- a/orchestrator/src/incus.ts
+++ b/orchestrator/src/incus.ts
@@ -31,7 +31,9 @@ const requireOk = (r: ExecResult, msg: string): ExecResult => {
   return r;
 };
 
-export const containerName = (userId: string): string => `${env.incus.prefix}${userId}`;
+// Incus 容器名只允许 [a-zA-Z0-9-],better-auth user id 是 user_xxx 带下划线 → 替换
+export const containerName = (userId: string): string =>
+  `${env.incus.prefix}${userId.replace(/[^a-zA-Z0-9-]/g, '-')}`;
 
 const projArgs = ['--project', env.incus.project];