Unable to enable QUIC eBPF routing.

Describe the bug

Attempting to utilise quic_bpf results in the following error:

2023/09/28 22:48:53 [alert] 1#1: failed to create BPF map (1: Operation not permitted)
nginx: [alert] failed to create BPF map (1: Operation not permitted)
2023/09/28 22:48:53 [emerg] 1#1: ngx_quic_bpf_module failed to initialize, check limits
nginx: [emerg] ngx_quic_bpf_module failed to initialize, check limits

I've attempted to set an unlimited RLIMIT_MEMLOCK, assign the relevant capabilities as defined at https://docs.nginx.com/nginx-service-mesh/reference/permissions (CAP_NET_ADMIN,CAP_NET_RAW,CAP_SYS_RESOURCE, and CAP_SYS_ADMIN), use the host network, pass the --privileged, unconfine Seccomp (--security-opt seccomp=unconfined), run NGINX as root (within the container), and all the above together but still receive the same error.

Running on the host seems to work fine, however.

To reproduce

Steps to reproduce the behavior:

1. Deploy the NGINX Docker image using podman run -d --name nginx -p 80:80/tcp -p 443:443/tcp -p 443:443/udp -v /srv/nginx:/etc/nginx -v /etc/letsencrypt:/etc/letsencrypt --restart unless-stopped --cap-add NET_ADMIN,NET_RAW,SYS_RESOURCE,BPF,PERFMON --net <REDACTED> --ulimit memlock=-1:-1 library/nginx:mainline (potentially including the flags mentioned above).
2. The container exits with the error shared above.

Expected behavior

Following a provision of the relevant capabilities and spare RLIMIT_MEMLOCK resources, QUIC eBPF routing should work fine.

Your environment

• podman version 4.6.2
• nginx:mainline

Additional context

n/a

Start by reproducing the failure with the provided Podman command and the nginx:mainline image, then trace the ngx_quic_bpf_module initialization reported in the error. Compare the container and host environments, including capabilities and memlock settings; done means identifying the missing container requirement or documenting a confirmed limitation with a reproducible configuration.