diff --git a/.env.example b/.env.example
index ecbe9f5..145a7a5 100644
--- a/.env.example
+++ b/.env.example
@@ -59,10 +59,6 @@ VERSION=2022
 RAM_SIZE=8G
 CPU_CORES=4
 DISK_SIZE=100G
-# QEMU disk I/O backend: native, threads or io_uring. Empty lets QEMU choose,
-# which is io_uring on recent kernels. Kernels before 5.12 (Ubuntu 20.04) fail
-# at boot with "Failed to initialize io_uring": set native there.
-# DISK_IO=native
 # Local administrator created by the unattended install; also the RDP login
 WIN_USERNAME=admin
 WIN_PASSWORD=runner
diff --git a/README.md b/README.md
index 3d1c914..f6be79e 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,6 @@ Two authentication methods are supported. Set **one** of them in `.env`:
     | `INSTALL_RTOOLS` | `true` | Install Rtools 4.0 with `mingw-w64-x86_64-make` |
     | `VERSION` | `2022` | dockur Windows release (`2022` = Windows Server 2022 evaluation) |
     | `RAM_SIZE` / `CPU_CORES` / `DISK_SIZE` | `8G` / `4` / `100G` | VM size |
-| `DISK_IO` | QEMU's choice | QEMU disk I/O backend: `native`, `threads` or `io_uring`. Kernels before 5.12 exit at boot with `Failed to initialize io_uring`; set `native` there |
     | `WIN_USERNAME` / `WIN_PASSWORD` | `admin` / `runner` | Local administrator created by the install, also the RDP login |
 
 2. Start it and follow the container side (ISO download, QEMU boot):
diff --git a/docker-compose.yml b/docker-compose.yml
index 3857725..c2b9b0f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -17,9 +17,6 @@ services:
       RAM_SIZE: "${RAM_SIZE:-8G}"
       CPU_CORES: "${CPU_CORES:-4}"
       DISK_SIZE: "${DISK_SIZE:-100G}"
-      # QEMU disk I/O backend; empty lets QEMU choose. Set DISK_IO=native in .env
-      # on kernels before 5.12 ("Failed to initialize io_uring" at boot).
-      DISK_IO: "${DISK_IO:-}"
       USERNAME: "${WIN_USERNAME:-admin}"
       PASSWORD: "${WIN_PASSWORD:-runner}"
     devices:
@@ -27,6 +24,15 @@ services:
       - /dev/net/tun
     cap_add:
       - NET_ADMIN
+    # QEMU 10.1+ uses io_uring for its event loop and, on recent kernels, for the
+    # disk. io_uring rings are locked memory, and the container default of a few
+    # hundred KB makes QEMU exit at boot with "Failed to initialize io_uring:
+    # Cannot allocate memory". Unlimited is what the QEMU and Elasticsearch
+    # docs recommend; it is not a privilege.
+    ulimits:
+      memlock:
+        soft: -1
+        hard: -1
     ports:
       - 8006:8006 # web console (noVNC), handy during the first install
       - 3389:3389/tcp # RDP