Well, this is kind of unexpected, but "highly secure" environments surely won't be running containers on the default bridge without any of the capabilities configured.