I execute it on the command line.

docker run -t -i centos:min /bin/bash

Show error message:

finalize namespace drop capabilities operation not permitted

May I ask what the problem is and how to make the mistake?