docs: add justification for added capabilities

Author: mo-getter

docker/common-services.yaml

@@ -220,7 +220,7 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
+      - DAC_READ_SEARCH  # required for reading log files in target container
     security_opt:
       - no-new-privileges:true
     environment:
@@ -245,7 +245,7 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
+      - DAC_READ_SEARCH  # required for reading log files in target container
     security_opt:
       - no-new-privileges:true
     environment:
@@ -270,7 +270,7 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
+      - DAC_READ_SEARCH  # required for reading log files in target container
     security_opt:
       - no-new-privileges:true
     environment:
@@ -295,8 +295,8 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
-      - SYS_PTRACE
+      - DAC_READ_SEARCH  # required for reading log files in target container
+      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
     security_opt:
       - no-new-privileges:true
     environment:

docker/internal-auth/compose.delegated-operators.gpu.yaml

@@ -55,8 +55,8 @@ services:
     pid: "service:teams-do-gpu"
     profiles: ["gpu"]
     cap_add:
-      - DAC_READ_SEARCH
-      - SYS_PTRACE
+      - DAC_READ_SEARCH  # required for reading log files in target container
+      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
     deploy:
       resources:
         limits:

docker/internal-auth/compose.delegated-operators.yaml

@@ -90,8 +90,8 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
-      - SYS_PTRACE
+      - DAC_READ_SEARCH  # required for reading log files in target container
+      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
     security_opt:
       - no-new-privileges:true
     environment:
@@ -154,8 +154,8 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
-      - SYS_PTRACE
+      - DAC_READ_SEARCH  # required for reading log files in target container
+      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
     security_opt:
       - no-new-privileges:true
     environment:

docker/legacy-auth/compose.delegated-operators.gpu.yaml

@@ -55,8 +55,8 @@ services:
     pid: "service:teams-do-gpu"
     profiles: ["gpu"]
     cap_add:
-      - DAC_READ_SEARCH
-      - SYS_PTRACE
+      - DAC_READ_SEARCH  # required for reading log files in target container
+      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
     deploy:
       resources:
         limits:

docker/legacy-auth/compose.delegated-operators.yaml

@@ -90,8 +90,8 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
-      - SYS_PTRACE
+      - DAC_READ_SEARCH  # required for reading log files in target container
+      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
     security_opt:
       - no-new-privileges:true
     environment:
@@ -156,8 +156,8 @@ services:
     cap_drop:
       - ALL
     cap_add:
-      - DAC_READ_SEARCH
-      - SYS_PTRACE
+      - DAC_READ_SEARCH  # required for reading log files in target container
+      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
     security_opt:
       - no-new-privileges:true
     environment: