diff --git a/daemon/execdriver/lxc/driver.go b/daemon/execdriver/lxc/driver.go
index 2faada2350..1d315ca3b7 100644
--- a/daemon/execdriver/lxc/driver.go
+++ b/daemon/execdriver/lxc/driver.go
@@ -123,11 +123,11 @@ func (d *driver) Run(c *execdriver.Command, pipes *execdriver.Pipes, startCallba
 	}
 
 	if len(c.CapAdd) > 0 {
-		params = append(params, "-cap-add", strings.Join(c.CapAdd, " "))
+		params = append(params, "-cap-add", strings.Join(c.CapAdd, ","))
 	}
 
 	if len(c.CapDrop) > 0 {
-		params = append(params, "-cap-drop", strings.Join(c.CapDrop, " "))
+		params = append(params, "-cap-drop", strings.Join(c.CapDrop, ","))
 	}
 
 	params = append(params, "--", c.Entrypoint)
diff --git a/daemon/execdriver/lxc/lxc_init_linux.go b/daemon/execdriver/lxc/lxc_init_linux.go
index 40956e442b..de7a6385a0 100644
--- a/daemon/execdriver/lxc/lxc_init_linux.go
+++ b/daemon/execdriver/lxc/lxc_init_linux.go
@@ -49,7 +49,19 @@ func finalizeNamespace(args *execdriver.InitArgs) error {
 			return fmt.Errorf("clear keep caps %s", err)
 		}
 
-		caps, err := execdriver.TweakCapabilities(container.Capabilities, strings.Split(args.CapAdd, " "), strings.Split(args.CapDrop, " "))
+		var (
+			adds  []string
+			drops []string
+		)
+
+		if args.CapAdd != "" {
+			adds = strings.Split(args.CapAdd, ",")
+		}
+		if args.CapDrop != "" {
+			drops = strings.Split(args.CapDrop, ",")
+		}
+
+		caps, err := execdriver.TweakCapabilities(container.Capabilities, adds, drops)
 		if err != nil {
 			return err
 		}
diff --git a/daemon/execdriver/utils.go b/daemon/execdriver/utils.go
index 90c5177421..d09e27fec0 100644
--- a/daemon/execdriver/utils.go
+++ b/daemon/execdriver/utils.go
@@ -20,7 +20,7 @@ func TweakCapabilities(basics, adds, drops []string) ([]string, error) {
 			continue
 		}
 		if !utils.StringsContainsNoCase(allCaps, cap) {
-			return nil, fmt.Errorf("Unknown capability: %s", cap)
+			return nil, fmt.Errorf("Unknown capability drop: %q", cap)
 		}
 	}
 
@@ -49,9 +49,8 @@ func TweakCapabilities(basics, adds, drops []string) ([]string, error) {
 			continue
 		}
 
-		// look for invalid cap in the drop list
 		if !utils.StringsContainsNoCase(allCaps, cap) {
-			return nil, fmt.Errorf("Unknown capability: %s", cap)
+			return nil, fmt.Errorf("Unknown capability to add: %q", cap)
 		}
 
 		// add cap if not already in the list
@@ -59,5 +58,6 @@ func TweakCapabilities(basics, adds, drops []string) ([]string, error) {
 			newCaps = append(newCaps, cap)
 		}
 	}
+
 	return newCaps, nil
 }