code: func TweakCapabilities(basics, adds, drops, capabilities []string, privileged bool) ([]string, error) {
  	switch {
  	case privileged:
  		// Privileged containers get all capabilities
  		return GetAllCapabilities(), nil
  	case capabilities != nil:
  		// Use custom set of capabilities
  		if err := ValidateCapabilities(capabilities); err != nil {
  			return nil, err
  		}
  		return capabilities, nil
  	case len(adds) == 0 && len(drops) == 0:
  		// Nothing to tweak; we're done
  		return basics, nil
  	}
  
  	capDrop, err := NormalizeLegacyCapabilities(drops)
  	if err != nil {
  		return nil, err
  	}
  	capAdd, err := NormalizeLegacyCapabilities(adds)
  	if err != nil {
  		return nil, err
  	}
  
  	var caps []string
  
  	switch {
  	case inSlice(capAdd, allCapabilities):
  		// Add all capabilities except ones on capDrop
  		for _, c := range GetAllCapabilities() {
  			if !inSlice(capDrop, c) {
  				caps = append(caps, c)
  			}
  		}
  	case inSlice(capDrop, allCapabilities):
  		// "Drop" all capabilities; use what's in capAdd instead
  		caps = capAdd
  	default:
  		// First drop some capabilities
  		for _, c := range basics {
  			if !inSlice(capDrop, c) {
  				caps = append(caps, c)
  			}
  		}
  		// Then add the list of capabilities from capAdd
  		caps = append(caps, capAdd...)
  	}
  	return caps, nil
  }
docs: // TweakCapabilities tweaks capabilities by adding, dropping, or overriding
  // capabilities in the basics capabilities list.