To expand on vngzs's post, many key Linux syscalls (such as opening a socket/file descriptor) always check if a bit is set in a capabilities bitfield, so the on

To expand on vngzs's post, many key Linux syscalls (such as opening a socket/file descriptor) always check if a bit is set in a capabilities bitfield, so the only extra overhead is the one-time syscall to drop some set of capabilities. Now, there is some overhead in forking a child process to have different capabilities than the parent, and some overhead in using a pipe/shared memory to communicate between the sandboxed child and the parent, but that overhead should be tiny compared to the work of decoding compressed video, etc.