Having actually read bits of man lxc.conf, add in sane set of default capabilities to drop.