chore: extend security section in readme

Author: bertschneider

README.md

@@ -22,18 +22,18 @@ When installed as linux package this configuration is in`/etc/steadybit/extensio
 
 The capabilities needed by this extension are: (which are provided by the helm chart)
 
-- SYS_ADMIN
-- SYS_RESOURCE
-- SYS_BOOT
-- NET_RAW
-- SYS_TIME
-- SYS_PTRACE
-- KILL
-- NET_ADMIN
-- DAC_OVERRIDE
-- SETUID
-- SETGID
-- AUDIT_WRITE
+- `SYS_ADMIN`
+- `SYS_RESOURCE`
+- `SYS_BOOT`
+- `NET_RAW`
+- `SYS_TIME`
+- `SYS_PTRACE`
+- `KILL`
+- `NET_ADMIN`
+- `DAC_OVERRIDE`
+- `SETUID`
+- `SETGID`
+- `AUDIT_WRITE`
 
 ## Installation
 
@@ -87,9 +87,27 @@ Make sure that the extension is registered with the agent. In most cases this is
 the [documentation](https://docs.steadybit.com/install-and-configure/install-agent/extension-discovery) for more
 information about extension registration and how to verify.
 
+## Security
+
+We try to limit the access needed for the extension to the absolute minimum. So the extension itself can run as a
+non-root user on a read-only root file-system and will, by default, if deployed using the provided helm chart.
+
+In order to execute certain actions the extension needs extended capabilities, see details below.
+
+### Resource and network attacks
+
+Resource attacks start `stress-ng` or other resource attacking processes, and network attacks start `ip` or `tc` processes,
+as runc container (sidecar) using the root user (`uid=0`, `gid=0`) and reusing the target container's linux namespace(s)
+and control group(s). These processes are short-lived and terminated after the attack is finished.
+
+This requires the following capabilities:
+`CAP_SYS_ADMIN`, `CAP_SYS_CHROOT`, `CAP_SYS_RESOURCE`, `CAP_SYS_BOOT`, `CAP_NET_RAW`, `CAP_SYS_TIME`, `CAP_SYS_PTRACE`,
+`CAP_KILL`, `CAP_NET_ADMIN`, `CAP_DAC_OVERRIDE`, `CAP_SETUID`, `CAP_SETGID`, `CAP_AUDIT_WRITE`
+
 ## Troubleshooting
 
-When the host is using cgroups v2 and the cgroup filesystem is mounted using the `nsdelegate` option will prevent that the action running processces in other cgroups (e.g. stress cpu/memory, disk fill) will fail.
+Using cgroups v2 on the host and `nsdelegate` to mount the cgroup filesystem will prevent
+the action from running processes in other cgroups (e.g. stress cpu/memory, disk fill).
 In that case you need to remount the cgroup filesystem without the `nsdelegate` option.
 
 ```sh