diff --git a/.env.example b/.env.example
index e1c890f..9b053e2 100644
--- a/.env.example
+++ b/.env.example
@@ -19,6 +19,7 @@ AUR_MAINTAINER_EMAIL=your@email.com
 # How often to poll the AUR for updates, in seconds (default: 3600 = 1 hour)
 POLL_INTERVAL_SECONDS=3600
 
-# Number of CPU cores to use for compilation (default: all available cores)
-# Reduce this if you want to leave headroom for other processes on the server
-# NPROC=4
+# Number of CPU cores to use for compilation (default: 4)
+# This controls both the make -jN parallelism inside the build and the CPU
+# cap enforced by Docker on the container. Set it once, it applies everywhere
+NPROC=4
diff --git a/README.md b/README.md
index 5a6a237..c4a0027 100644
--- a/README.md
+++ b/README.md
@@ -37,16 +37,16 @@ cp .env.example .env
 
 Edit `.env` and fill in:
 
-| Variable                  | Description                                                           |
-|---------------------------|-----------------------------------------------------------------------|
-| `GITHUB_TOKEN`            | Personal access token with **Contents: read/write** on this repo      |
-| `GITHUB_REPO`             | `Brodino96/webkit2gtk-automator`                                      |
-| `AUR_SSH_KEY_PATH`        | Absolute path to the SSH private key registered on your AUR account   |
-| `AUR_PACKAGE_NAME`        | `webkit2gtk-bin`                                                      |
-| `AUR_MAINTAINER_NAME`     | Your name (written into the published PKGBUILD)                       |
-| `AUR_MAINTAINER_EMAIL`    | Your email (written into the published PKGBUILD)                      |
-| `POLL_INTERVAL_SECONDS`   | How often to check for updates, in seconds (default: `3600`)          |
-| `NPROC`                   | CPU cores to use for compilation (default: all available)             |
+| Variable                  | Description                                                                       |
+|---------------------------|-----------------------------------------------------------------------------------|
+| `GITHUB_TOKEN`            | Personal access token with **Contents: read/write** on this repo                  |
+| `GITHUB_REPO`             | `Brodino96/webkit2gtk-automator`                                                  |
+| `AUR_SSH_KEY_PATH`        | Absolute path to the SSH private key registered on your AUR account               |
+| `AUR_PACKAGE_NAME`        | `webkit2gtk-bin`                                                                  |
+| `AUR_MAINTAINER_NAME`     | Your name (written into the published PKGBUILD)                                   |
+| `AUR_MAINTAINER_EMAIL`    | Your email (written into the published PKGBUILD)                                  |
+| `POLL_INTERVAL_SECONDS`   | How often to check for updates, in seconds (default: `3600`)                      |
+| `NPROC`                   | CPU cores for compilation, also caps the container's CPU quota (default: `4`)     |
 
 **3) Start the daemon**
 ```bash
diff --git a/docker-compose.yml b/docker-compose.yml
index 1be9df4..d14f412 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,14 +8,16 @@ services:
     restart: unless-stopped
     env_file:
       - .env
-    # By default Docker exposes all host CPUs to the container.
-    # You can cap it here or set NPROC in .env to limit parallelism at the build level.
-    # cpus: '4'
+    # NPROC in .env controls both the number of compiler jobs (make -jN) and
+    # the CPU cap enforced by the kernel. Set it once, it applies everywhere
+    cpus: '${NPROC:-4}'
+    mem_limit: 12g
+    memswap_limit: 12g
     volumes:
       # Entire project mounted so the container can read/write state, artifacts,
-      # and the webkit2gtk / webkit2gtk-bin git repos.
+      # and the webkit2gtk / webkit2gtk-bin git repos
       - .:/workspace
       # AUR SSH private key (path set in .env via AUR_SSH_KEY_PATH)
       - ${AUR_SSH_KEY_PATH}:/run/secrets/aur_id_rsa:ro
-    # No ports needed – this is a pure background worker.
+    # No ports needed – this is a pure background worker
     # Logs are available via: docker compose logs -f