Why does Vault by HashiCorp require the ipc_lock capability to be enabled?
It's required for this server config option: https://www.vaultproject.io/docs/configuration/index.html#disable_mlock
It uses the mlock syscall which blocks process memory from being swapped to disk. By default this is enabled as you want to avoid swapping your Vault memory onto unencrypted disk.
Usually that capability comes up when running Vault within a container, which I believe allows the container to access the mlock syscall without escalating privileges.