Containers, even with root user, are often stripped of these capabilities unless --privileged