updated make docs

rig/docs/notes/docs.md

@@ -8,6 +8,12 @@ out `python -m http.server` too — a minimal Debian has no python3. What it doe
 have, by definition, is Docker: the single prerequisite rig already demands. So a
 throwaway nginx container serves a read-only bind mount.
 
+nginx runs as the caller (`--user`), not as its own `nginx` user. A machine whose umask is
+027 creates files readable by their owner and group only, and nginx's own user would get a
+403 on every page. As the caller it reads whatever the caller can, so nobody has to chmod
+their docs. Unprivileged, it listens on 8080 inside the container and keeps its pid and temp
+files in /tmp.
+
 It runs with a config of its own: one worker (nginx's `auto` starts one per core,
 twelve on an ordinary laptop, for a handful of static pages), no access log and a
 quiet entrypoint, so the terminal shows the URL and nothing else unless something