Pin image versions

- docker-compose: victoria-logs v1.52.0 and docker-socket-proxy v0.5.0,
  the versions running on sandbox.
- Dockerfile: golang 1.27.1-alpine3.24 and alpine 3.24.2 (Go 1.23 and
  Alpine 3.20 no longer receive security fixes).
- README: pinned versions and how to update them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -28,8 +28,8 @@ services:
       logstream.exclude: "true"      # never collect Logstream's own logs
 
   victorialogs:
-    # Pin a specific version in production (see hub.docker.com/r/victoriametrics/victoria-logs/tags)
-    image: victoriametrics/victoria-logs:latest
+    # Pinned version: see "Updating" in the README before changing it
+    image: victoriametrics/victoria-logs:v1.52.0
     container_name: logstream-victorialogs
     restart: unless-stopped
     command:
@@ -47,7 +47,7 @@ services:
     # Read-only gateway to the Docker API: Logstream can only list containers,
     # read their logs, receive events and engine info. Anything else (start,
     # stop, exec, images, volumes…) is refused.
-    image: tecnativa/docker-socket-proxy:latest
+    image: tecnativa/docker-socket-proxy:v0.5.0
     container_name: logstream-docker-proxy
     restart: unless-stopped
     environment: