code: func WithCapabilities(c *container.Container) coci.SpecOpts {
  	return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
  		capabilities, err := caps.TweakCapabilities(
  			oci.DefaultCapabilities(),
  			c.HostConfig.CapAdd,
  			c.HostConfig.CapDrop,
  			c.HostConfig.Capabilities,
  			c.HostConfig.Privileged,
  		)
  		if err != nil {
  			return err
  		}
  		return oci.SetCapabilities(s, capabilities)
  	}
  }
docs: // WithCapabilities sets the container's capabilties