Merge pull request #1804 from vonneudeck/patch-1

Added info about where to add/drop capabilities

docs/user-guide/containers.md

@@ -94,3 +94,23 @@ The relationship between Docker's capabilities and [Linux capabilities](http://m
 | SETFCAP |  CAP_SETFCAP |
 | WAKE_ALARM |  CAP_WAKE_ALARM |
 | BLOCK_SUSPEND |  CAP_BLOCK_SUSPEND |
+
+You can add or drop capabilities in the [`SecurityContext`](http://kubernetes.io/docs/api-reference/v1/definitions/#_v1_securitycontext), e.g.:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hello-world
+spec:
+  containers:
+  - name: friendly-container
+    image: "alpine:3.4"
+    command: ["/bin/echo", "hello", "world"]
+    securityContext:
+      capabilities:
+        add:
+        - SYS_NICE
+        drop:
+        - KILL
+```