# UNDF: UNDF-2026-000000172
--- a/daemon/pkg/oci/caps/utils.go
+++ b/daemon/pkg/oci/caps/utils.go
@@ -93,16 +93,24 @@ func TweakCapabilities(basics, adds, drops []string, privileged bool) ([]string,

 	var caps []string

+	// Build a set from capDrop so membership tests are O(1) instead of O(n).
+	dropSet := make(map[string]struct{}, len(capDrop))
+	for _, c := range capDrop {
+		dropSet[c] = struct{}{}
+	}
+	addSet := make(map[string]struct{}, len(capAdd))
+	for _, c := range capAdd {
+		addSet[c] = struct{}{}
+	}
+
 	switch {
-	case slices.Contains(capAdd, allCapabilities):
+	case func() bool { _, ok := addSet[allCapabilities]; return ok }():
 		// Add all capabilities except ones on capDrop
 		for _, c := range GetAllCapabilities() {
-			if !slices.Contains(capDrop, c) {
+			if _, dropped := dropSet[c]; !dropped {
 				caps = append(caps, c)
 			}
 		}
-	case slices.Contains(capDrop, allCapabilities):
+	case func() bool { _, ok := dropSet[allCapabilities]; return ok }():
 		// "Drop" all capabilities; use what's in capAdd instead
 		caps = capAdd
 	default:
 		// First drop some capabilities
 		for _, c := range basics {
-			if !slices.Contains(capDrop, c) {
+			if _, dropped := dropSet[c]; !dropped {
 				caps = append(caps, c)
 			}
 		}