capability: Clarify what insecure memory means

server/src/capability.rs

@@ -122,12 +122,17 @@ pub fn drop_unnecessary_capabilities() -> Result<(), rustix::io::Errno> {
             )?;
         }
         CapabilityState::None => {
-            tracing::warn!("No process capabilities, insecure memory might get used");
+            // NOTE: For users that landed here. The binary is probably missing
+            // the CAP_IPC_LOCK capability which should have been set as part of
+            // packaging. See capabilities(7) and setcap(8) for more details.
+            tracing::warn!("No process capabilities, secrets in memory might be swapped to disk");
             return Ok(());
         }
         CapabilityState::Partial => {
             if !caps.effective.contains(CapabilitySet::IPC_LOCK) {
-                tracing::warn!("Insufficient process capabilities, insecure memory might get used");
+                tracing::warn!(
+                    "Missing IPC_LOCK capability, secrets in memory might be swapped to disk"
+                );
             }
 
             // Clear bounding set if we have CAP_SETPCAP (do this before dropping caps)