Claude Code never started. fork/exec of /usr/local/bin/claude returned operation not permitted. The container had dropped every capability, and the child still tried to become uid 1000. Left alone, claude --version prints 2.1.316. I put back only CAP_SETUID and CAP_SETGID. The old container still has an empty capability set.