Put Docker Socket Proxy in front of every container that needs the Docker API instead of mounting docker.sock directly

content/en/3.serveex/4.monitoring/2.dozzle.md

@@ -43,10 +43,41 @@ services:
       - .env
     environment:
       - DOZZLE_HOSTNAME=${DOMAIN}
+      - DOCKER_HOST=tcp://docker-socket-proxy:2375
+    networks:
+      - dozzle-internal
+    depends_on:
+      - docker-socket-proxy
+
+  docker-socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: docker-socket-proxy-dozzle
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - dozzle-internal
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+      - IMAGES=1
+      - INFO=1
+      - EVENTS=1
+      - ALLOW_LOGS=1
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /run
+
+networks:
+  dozzle-internal:
+    name: dozzle-internal
 ```
 
+::note
+Dozzle only ever reads container logs, so this config sits **Docker Socket Proxy** in front of the Docker API instead of mounting `/var/run/docker.sock` directly, keeping `POST` disabled entirely: Dozzle can list containers and stream their logs, and nothing else.
+::
+
 ::tip{icon=""}
 ✨ __Tip:__ Add the watchtower label to each container to automate updates