title: Difference between --cap-add=NET_ADMIN and add capabilities in .yml
body: <p>i have a question and a problem about capabilities.</p>
  
  <p>Why my program work when i run <code>docker run --cap-add=NET_ADMIN ...</code> ?</p>
  
  <p>And it's doesn't work if i run my program with file .yml which is:</p>
  
  <pre><code>      containers:
        - name: snake
          image: docker.io/kelysa/snake:lastest
          imagePullPolicy: Always
          securityContext:
            privileged: true
            capabilities:
              add: ["NET_ADMIN","NET_RAW"]
  </code></pre>
  
  <p>What is the difference between run docker with --cap-add and run a pod with the same capabilities ? </p>