diff --git a/src/vm.ts b/src/vm.ts
index 6086254..4d4396b 100644
--- a/src/vm.ts
+++ b/src/vm.ts
@@ -30,7 +30,7 @@ export async function ensure(log?: (msg: string) => void): Promise<void> {
   // Create from scratch
   const home = homedir()
   log?.("Pulling image & creating container")
-  await $`container run -d --name ${CONTAINER_NAME} -m 4G -v ${home}/dev:${home}/dev -v ${home}/.sandlot:${home}/.sandlot ubuntu:24.04 sleep infinity`.quiet()
+  await $`container run -d --name ${CONTAINER_NAME} -m 4G --mount type=bind,source=${home}/dev,target=${home}/dev,readonly -v ${home}/.sandlot:${home}/.sandlot ubuntu:24.04 sleep infinity`.quiet()
 
   // Provision (as root)
   log?.("Installing packages")