From c602fe68c1cffca96764cb676f283b9a0c2b80f9 Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Sun, 30 Aug 2026 12:44:59 -0500
Subject: [PATCH] note the uid trade-off in user: mode

---
 docs/docs/configuration/non_root.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/docs/configuration/non_root.md b/docs/docs/configuration/non_root.md
index 1895c1b5af..a45b66680d 100644
--- a/docs/docs/configuration/non_root.md
+++ b/docs/docs/configuration/non_root.md
@@ -265,7 +265,7 @@ What each device needs when you're setting it up by hand. The automatic grant co
 
 ## Hardened deployment
 
-Docker's `user:` mode is the only run mode that supports `read_only: true`. Together they're the strongest supported configuration: the container never starts as root, and it can't modify its own filesystem.
+Docker's `user:` mode is the only run mode that supports `read_only: true`. The container never starts as root and can't modify its own filesystem. The trade-off is that every service runs as the single uid you pass, so go2rtc no longer gets its own more restricted user the way it does in the default mode.
 
 ```yaml
 services: