chore(code-server): mount the docker socket read-only

The flag does not restrict Docker API access; the README says so.

code-server/README.md

@@ -21,6 +21,12 @@ is the same `PASSWORD`) or add the group by hand. Handing a container the
 socket is equivalent to giving it root on the host -- that is accepted here
 because this is a single-user dev box.
 
+The mount carries `:ro`, which is not a security boundary: it only marks the
+socket file read-only, while the Docker API is reached by connecting to the
+socket, which a read-only mount does not stop. Full API access, and with it
+root on the host, remains. Restricting that would need a socket proxy or a
+separate rootless daemon.
+
 ## Environment
 
 | Variable | Purpose |

code-server/compose.yml

@@ -20,6 +20,6 @@ services:
       - PWA_APPNAME=code-server
     volumes:
       - 'code-server-config:/config'
-      - '/var/run/docker.sock:/var/run/docker.sock'
+      - '/var/run/docker.sock:/var/run/docker.sock:ro'
 volumes:
   code-server-config: