lxc.cap.drop:
lxc.cap.drop: mac_admin mac_override sys_module