document why CAP_SYS_ADMIN is required

README.md

@@ -1,5 +1,16 @@
 TODO drop caps
 
+`SYS_ADMIN` currently required to work around:
+```
+(EE) modeset(0): drmSetMaster failed: Permission denied
+Fatal server error:
+(EE) AddScreen/ScreenInit failed for driver 0
+```
+caused by
+```
+ioctl(10, DRM_IOCTL_SET_MASTER, 0) = -1 EACCES (Permission denied)
+```
+
 ```sh
 sudo docker build -t xorg-test .
 sudo docker run --rm -it \