What Linux capabilities-related hardening would you apply to a production container?

Drop all default Linux capabilities with --cap-drop=ALL, then add back only the specific capabilities the application genuinely requires (e.g., NET_BIND_SERVICE if it needs to bind a privileged port below 1024). Combine this with --security-opt=no-new-privileges to prevent setuid binaries from escalating privileges inside the container, even if such a binary exists in the image.