feat(security): describe root start risk

Author: JoergSiebahn

docs/security/index.md

@@ -14,6 +14,14 @@ Custom critical resources can be exposed at the management port by implementing
 `org.springframework.boot.actuate.endpoint.web.annotation.RestControllerEndpoint` or
 `org.springframework.boot.actuate.endpoint.web.annotation.ControllerEndpoint`.
 
+## Risk: Root start
+
+If the service is started with extended privileges as the root user, an attacker can more easily
+attack the operating system after taking over from the container.
+
+The default configuration is capable to run as no root, listening to ports 8080 and 8081.
+Deployment checks must ensure, that the container is not configured with a root user.
+
 ## Risk: Exploitation of HTTP methods
 
 The HTTP method `TRACE` is disabled by default to mitigate [Cross Site Tracing](https://owasp.org/www-community/attacks/Cross_Site_Tracing).