We received manifests from another team running CRI-O in their cluster, while we are using containerd. When we deployed their manifests, all hell broke loose.

We discovered that the team using CRI-O had under securityContext specified capabilities with the CAP_ prefix, which does not work in containerd.

According to the Kubernetes documentation:

Note:
Linux capability constants have the form CAP_XXX. However, when you list capabilities in your container manifest, you must omit the CAP_ portion of the constant. For example, to add CAP_SYS_TIME, include SYS_TIME in your list of capabilities.

Source: Kubernetes Documentation

So, what is up with this? Why does CRI-O allow the CAP_ prefix for capabilities, while containerd does not?