🎨 Improve structure and documentation of run

run

@@ -1,3 +1,14 @@
 #!/bin/sh
-# XXX Do not run privileged, use udica instead
-docker run --user `id -u`:`id -g` --rm -t --mount type=bind,src="$(pwd)",target=/data --privileged=true -e LOG_LEVEL=$LOG_LEVEL my_ocrd_workflow
+# Run the my_ocrd_workflow container on the current workspace
+
+# The container currently needs to run privileged to allow it to read from e.g.
+# /home on SELinux secured systems such as Fedora. We might want to use udica
+# instead in the future.
+
+docker run --privileged=true --rm -t \
+  \
+  --user `id -u`:`id -g` \
+  --mount type=bind,src="$(pwd)",target=/data \
+  \
+  -e LOG_LEVEL=$LOG_LEVEL \
+  my_ocrd_workflow