unshare(CLONE_NEWNS) failed in Dockerfile RUN, is this a bug?

[loynoir]

brief

unshare(CLONE_NEWNS) failed in Dockerfile RUN, is this a bug?

background

When I try to run nix flake within Dockerfile RUN

...

RUN nix ... run --option sandbox-fallback false ... /path/to/flake

nix failed, seems due to

NixOS/nix#16186 (comment)

0.184 unshare(CLONE_NEWNS)                    = -1 EPERM (Operation not permitted)
11.85 clone(child_stack=0x71f6e378eff0, flags=CLONE_NEWUSER|SIGCHLD) = -1 EPERM (Operation not permitted)
11.85 munmap(0x71f6e368f000, 1048576)         = 0
11.85 mmap(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x71f6e368f000
11.85 clone(child_stack=0x71f6e378eff0, flags=CLONE_NEWNS|CLONE_NEWPID|SIGCHLD) = -1 EPERM (Operation not permitted)

problem

1. unshare(CLONE_NEWNS) failed, is this a bug?

2. If this is not a bug, is there a reason?

3. If this is not a bug, what extra steps are needed to have unshare(CLONE_NEWNS)?