What is the purpose of capabilities in the context of container virtualization?

A: Map potentially dangerous system calls to an emulation layer provided by the container virtualization. B: Restrict the disk space a container can consume. C: Enable memory deduplication to cache files which exist in multiple containers. D: Allow regular users to start containers with elevated permissions. E: Prevent processes from performing actions which might infringe the container.