implement copilot and rabbitai suggestions

examples/directory-bind-mount/README.md

@@ -16,9 +16,9 @@ It uses the simplified setup (no remote mounts).
 cp .env.example .env
 ```
 
-1. Edit `.env` and set `HOST_DATA_DIR` to the directory you want to back up.
+2. Edit `.env` and set `HOST_DATA_DIR` to the directory you want to back up.
 
-1. Start the stack:
+3. Start the stack:
 
 ```bash
 docker compose up -d

examples/directory-bind-mount/docker-compose.yml

@@ -10,4 +10,4 @@ services:
     volumes:
       - /etc/localtime:/etc/localtime:ro
       - /var/lib/zerobyte:/var/lib/zerobyte
-      - ${HOST_DATA_DIR}:/mydata
+      - ${HOST_DATA_DIR:?HOST_DATA_DIR must be set}:/mydata

examples/rclone-config-mount/README.md

@@ -23,9 +23,9 @@ rclone config
 cp .env.example .env
 ```
 
-1. Edit `.env` and set `RCLONE_CONFIG_DIR` to the absolute path of your host rclone config directory.
+2. Edit `.env` and set `RCLONE_CONFIG_DIR` to the absolute path of your host rclone config directory.
 
-1. Start the stack:
+3. Start the stack:
 
 ```bash
 docker compose up -d

examples/secrets-placeholders/.gitignore

@@ -0,0 +1,5 @@
+# Secret files - do not commit
+smb-password.txt
+*-password.txt
+*.secret
+*.key

examples/secrets-placeholders/README.md

@@ -27,13 +27,15 @@ This example includes `SYS_ADMIN` and `/dev/fuse` because it’s intended for SM
 cp .env.example .env
 ```
 
-1. Create a Docker secret file (this file is not meant to be committed):
+2. Create a Docker secret file.
+
+	⚠️ **Important**: never commit real credentials. This folder includes a `.gitignore` to help prevent accidentally committing secret files.
 
 ```bash
 printf "your-smb-password" > smb-password.txt
 ```
 
-1. Start Zerobyte:
+3. Start Zerobyte:
 
 ```bash
 docker compose up -d

examples/tailscale-sidecar/docker-compose.yml

@@ -35,6 +35,11 @@ services:
     image: ghcr.io/nicotsx/zerobyte:latest
     container_name: zerobyte
     restart: unless-stopped
+    # Uncomment if you need to mount NFS/SMB/WebDAV volumes:
+    # cap_add:
+    #   - SYS_ADMIN
+    # devices:
+    #   - /dev/fuse:/dev/fuse
     # Share the Tailscale network namespace (sidecar pattern)
     network_mode: service:tailscale
     depends_on: