You obviously don't want to give the user(s) root on the box so you give them CAP_FOWNER or CAP_DAC_OVERRIDE.
你绝对不会想给用户机器的root权限，所以你会给他们CAP_FOWNER或CAP_DAC_OVERRIDE。