What is Linux capabilities and seccomp in Container Security?

Linux capabilities split root privileges into smaller units, while seccomp restricts available system calls. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.