What does `--cap-drop=ALL` followed by selectively adding capabilities back accomplish?

It follows the principle of least privilege at the Linux capability level — instead of granting a container the default broad capability set, you drop everything and re-add only the specific capabilities the application actually needs, minimizing what a compromised process could do.