What is a common mistake with Linux capabilities and seccomp in Container Security?

Running containers with privileged mode or broad capabilities for convenience largely defeats isolation. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.