From 6dbb6c5f55334e1f4eace94e612fc182e5e63f65 Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <danny@ecommons.space>
Date: Mon, 17 Aug 2026 16:09:34 +0200
Subject: [PATCH] fix: mount containerd socket read-only, avoid abra#900

---
 compose.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index cd80e74..d9a740e 100644
--- a/compose.yml
+++ b/compose.yml
@@ -13,7 +13,11 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - /sys:/sys:ro
       - /var/lib/docker:/var/lib/docker:ro
-      - "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}:/run/containerd/containerd.sock"
+      # long-form avoids toolshed/abra#900
+      - type: bind
+        source: "${CONTAINERD_SOCKET:-/run/containerd/containerd.sock}"
+        target: /run/containerd/containerd.sock
+        read_only: true
       - alloy-data:/var/lib/alloy/data
     # runs through a shell so ALLOY_HTTP_LISTEN_ADDR (set by
     # compose.alloy-webui.yml) is resolved from the container's own