title: Docker-Compose: order of cap_drop and cap_add?
body: <p>The <a href="https://docs.docker.com/compose/compose-file/#cap_add-cap_drop" rel="noreferrer">docker compose file reference</a> describes the <code>cap_add</code> and <code>cap_drop</code> elements in a rather terse fashion:</p>
  <blockquote>
  <p>Add or drop container capabilities. See man 7 capabilities for a full list.</p>
  </blockquote>
  <p>Do these elements have an order, that is, add first, then drop? Or does the order matter (is this supported in YAML at all for dictionaries?)?</p>
  <p>What happens when one of <code>cap_add</code> or <code>cap_drop</code> contains <code>ALL</code>?</p>
  <p>I'm aware of the Docker Linux default set of capabilities, defined in <a href="https://github.com/moby/moby/blob/master/oci/caps/defaults.go#L4" rel="noreferrer">https://github.com/moby/moby/blob/master/oci/caps/defaults.go#L4</a>.</p>