capabilities

The username tells you almost nothing. The interviewer wants the list of privilege transitions reachable from that process, and which of them you would have closed in advance.

Capabilities split root into pieces, but some pieces are nearly the whole thing. A strong answer knows the sets, the dangerous capabilities, and why 'drop all, add one' is the only defensible default.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.

Review capability metadata, trusted labels, derived values and actual release policy. Work through allowed sharing, forbidden audiences, branch influence and uncovered runtime paths.