I don’t think I have any insight into this right now. Does the same operation succeed if you omit the --cap-drop=ALL part?
--cap-drop=ALL