turn: add note on why we still use host mode

src/services.js

@@ -1017,9 +1017,9 @@ async function startTurn(existingInfra) {
     const readOnly = !serviceConfig.recoveryMode ? '--read-only' : '';
     const cmd = serviceConfig.recoveryMode ? '/bin/bash -c \'echo "Debug mode. Sleeping" && sleep infinity\'' : '';
 
-    // this exports 3478/tcp, 5349/tls and 50000-51000/udp. note that this runs on the host network because docker's userland proxy
-    // is spun for every port. we can disable this in some future release with --userland-proxy=false
-    // https://github.com/moby/moby/issues/8356 and https://github.com/moby/moby/issues/14856
+    // docker's userland proxy spins a process for every mapped port. this makes exposing port ranges unviable
+    // despite  --userland-proxy=false, docker create a firewall rule for each port in a range. this takes over 20s to start/stop containers
+    // https://github.com/moby/moby/issues/8356 and https://github.com/moby/moby/issues/14856 https://github.com/moby/moby/issues/36214
     const runCmd = `docker run --restart=always -d --name=turn \
                 --hostname turn \
                 --net host \