diff --git a/code-server/README.md b/code-server/README.md
index 6ae9f29..a3afefc 100644
--- a/code-server/README.md
+++ b/code-server/README.md
@@ -21,6 +21,12 @@ is the same `PASSWORD`) or add the group by hand. Handing a container the
 socket is equivalent to giving it root on the host -- that is accepted here
 because this is a single-user dev box.
 
+The mount carries `:ro`, which is not a security boundary: it only marks the
+socket file read-only, while the Docker API is reached by connecting to the
+socket, which a read-only mount does not stop. Full API access, and with it
+root on the host, remains. Restricting that would need a socket proxy or a
+separate rootless daemon.
+
 ## Environment
 
 | Variable | Purpose |
diff --git a/code-server/compose.yml b/code-server/compose.yml
index 290cfcf..544f835 100644
--- a/code-server/compose.yml
+++ b/code-server/compose.yml
@@ -20,6 +20,6 @@ services:
       - PWA_APPNAME=code-server
     volumes:
       - 'code-server-config:/config'
-      - '/var/run/docker.sock:/var/run/docker.sock'
+      - '/var/run/docker.sock:/var/run/docker.sock:ro'
 volumes:
   code-server-config: