fix: mount containerd socket read-only, avoid abra#900

2026-08-17 16:09:44 +02:00
parent 17c4f6237b
commit 6dbb6c5f55
1 changed files with 5 additions and 1 deletions
@@ -13,7 +13,11 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /sys:/sys:ro
      - /var/lib/docker:/var/lib/docker:ro
-      - "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}:/run/containerd/containerd.sock"
+      # long-form avoids toolshed/abra#900
+      - type: bind
+        source: "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}"
+        target: /run/containerd/containerd.sock
+        read_only: true
      - alloy-data:/var/lib/alloy/data
    # runs through a shell so ALLOY_HTTP_LISTEN_ADDR (set by
    # compose.alloy-webui.yml) is resolved from the container's own