https://bugzilla.redhat.com/show_bug.cgi?id=2334087
--- Comment #2 from Jan Pazdziora adelton@fedoraproject.org --- I've verified that adding --cap-add=cap_dac_read_search to the $docker run also addresses the problem.
So the issue seems to be that cap_dac_read_search is not among the default set of capabilities that containers get.