Can't run bubblewrap inside bubblewrap when using --cap-add

These work:
`bwrap --dev-bind / / --cap-add ALL -- chroot / sh`
`bwrap --dev-bind / / -- bwrap --dev-bind / / -- sh`
This doesn't:
`bwrap --dev-bind / / --cap-add ALL -- bwrap --dev-bind / / -- sh`
It tells me: `bwrap: Unexpected capabilities but not setuid, old file caps config?`

I am using bubblewrap from NixOS, so it's not setuid and has no capabilities or other special permissions.

Is this supposed not to work? It seems to be triggered by [this piece of code](https://github.com/containers/bubblewrap/blob/bae85baf7208c4acddd9cf032059d1429f179e4a/bubblewrap.c#L780); is it insecure if bubblewrap somehow has capabilities set by a parent bubblewrap? Can't the capabilities somehow be dropped?