[kro]

Containers, even with root user, are often stripped of these capabilities unless --privileged

[kro]

However, some privs can be gained in namespaces/unshare.