google sandboxed api fails in docker

To reproduce:

Create and run a docker container with ubuntu 18.04 (also tried running with `--privileged`). Then, follow the quick start from the sandboxed api main page [https://developers.google.com/sandboxed-api/docs/overview](url). The run fails at the following command (from the quick start):

`bazel run //sandboxed_api/examples/stringop:main_stringop`

The error is:

`[==========] Running 6 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 6 tests from StringopTest
[ RUN ] StringopTest.ProtobufStringDuplication
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
WARNING: Logging before InitGoogleLogging() is written to STDERR
E20200710 03:08:35.924361 4259 executor.cc:162] Could not obtain init PID
[sandboxed_api/sandbox2/comms.cc : 535] RAW: write: Bad file descriptor [9]
[sandboxed_api/sandbox2/forkserver.cc : 188] RAW: Sending PB to the ForkServer failed
E20200710 03:08:35.925424 4260 executor.cc:162] Could not obtain init PID
E20200710 03:08:35.925566 4247 transaction.cc:61] Tried 2 times to run the transaction, but it failed. SAPI error: 'UNAVAILABLE: Could not start the sandbox'. Latest sandbox error: 'SETUP_ERROR - Code: FAILED_SUBPROCESS'
sandboxed_api/examples/stringop/main_stringop.cc:61: Failure
Value of: st.Run([](sapi::Sandbox* sandbox) -> absl::Status { StringopApi api(sandbox); stringop::StringDuplication proto; proto.set_input("Hello"); sapi:✌️:Protostringop::StringDuplication pp(proto); { auto _sapi_statusor61 = (api.pb_duplicate_string(pp.PtrBoth())); if ((__builtin_expect(!_sapi_statusor61.ok(), 0))) { return _sapi_statusor61.status(); } int return_value = std::move(_sapi_statusor61).ValueOrDie();; if (!(return_value)) { return absl::FailedPreconditionError("pb_duplicate_string() failed"); }; } auto _sapi_statusor61 = (pp.GetMessage()); if ((__builtin_expect(!_sapi_statusor61.ok(), 0))) { return _sapi_statusor61.status(); } auto pb_result = std::move(_sapi_statusor61).ValueOrDie();; google::LogMessage( "sandboxed_api/examples/stringop/main_stringop.cc", 61).stream() << "Result PB: " << pb_result.DebugString(); if (!(pb_result.output() == "HelloHello")) { return absl::FailedPreconditionError("Incorrect output"); }; return absl::OkStatus(); })
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.ProtobufStringDuplication (19 ms)
[ RUN ] StringopTest.ProtobufStringReversal
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.932246 4262 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:66: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.ProtobufStringReversal (7 ms)
[ RUN ] StringopTest.RawStringDuplication
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.938766 4264 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:82: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringDuplication (7 ms)
[ RUN ] StringopTest.RawStringReversal
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.945513 4266 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:98: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringReversal (6 ms)
[ RUN ] StringopTest.RawStringLength
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.952450 4268 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:134: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringLength (7 ms)
[ RUN ] StringopTest.RawStringReading
[sandboxed_api/sandbox2/util.cc : 138] RAW: clone(): Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 559] RAW: Check (pid != -1) failed: failed to fork initial namespaces process: Operation not permitted [1]
[sandboxed_api/sandbox2/forkserver.cc : 219] RAW: Receiving init PID from the ForkServer failed
E20200710 03:08:35.958746 4270 executor.cc:162] Could not obtain init PID
sandboxed_api/examples/stringop/main_stringop.cc:144: Failure
Value of: sandbox.Init()
Expected: is OK
Actual: UNAVAILABLE: Could not start the sandbox (of type absl::Status), which is not OK
[ FAILED ] StringopTest.RawStringReading (7 ms)
[----------] 6 tests from StringopTest (53 ms total)

[----------] Global test environment tear-down
[==========] 6 tests from 1 test suite ran. (53 ms total)
[ PASSED ] 0 tests.
[ FAILED ] 6 tests, listed below:
[ FAILED ] StringopTest.ProtobufStringDuplication
[ FAILED ] StringopTest.ProtobufStringReversal
[ FAILED ] StringopTest.RawStringDuplication
[ FAILED ] StringopTest.RawStringReversal
[ FAILED ] StringopTest.RawStringLength
[ FAILED ] StringopTest.RawStringReading

6 FAILED TESTS`