How should Linux capabilities and seccomp be designed for production in Container Security?

Drop all capabilities by default, add only required ones, use a tested seccomp profile, and prohibit privileged workloads except controlled exceptions.