code: func (s *defaultCapabilities) Generate(pod *api.Pod, container *api.Container) (*api.Capabilities, error) {
  	defaultAdd := makeCapSet(s.defaultAddCapabilities)
  	requiredDrop := makeCapSet(s.requiredDropCapabilities)
  	containerAdd := sets.NewString()
  	containerDrop := sets.NewString()
  
  	var containerCapabilities *api.Capabilities
  	if container.SecurityContext != nil && container.SecurityContext.Capabilities != nil {
  		containerCapabilities = container.SecurityContext.Capabilities
  		containerAdd = makeCapSet(container.SecurityContext.Capabilities.Add)
  		containerDrop = makeCapSet(container.SecurityContext.Capabilities.Drop)
  	}
  
  	// remove any default adds that the container is specifically dropping
  	defaultAdd = defaultAdd.Difference(containerDrop)
  
  	combinedAdd := defaultAdd.Union(containerAdd)
  	combinedDrop := requiredDrop.Union(containerDrop)
  
  	// no changes? return the original capabilities
  	if (len(combinedAdd) == len(containerAdd)) && (len(combinedDrop) == len(containerDrop)) {
  		return containerCapabilities, nil
  	}
  
  	return &api.Capabilities{
  		Add:  capabilityFromStringSlice(combinedAdd.List()),
  		Drop: capabilityFromStringSlice(combinedDrop.List()),
  	}, nil
  }
docs: // Generate creates the capabilities based on policy rules.  Generate will produce the following:
  // 1.  a capabilities.Add set containing all the required adds (unless the
  // 		container specifically is dropping the cap) and container requested adds
  // 2.  a capabilities.Drop set containing all the required drops and container requested drops
  //
  // Returns the original container capabilities if no changes are required.