How to enable an dotnet 6 client app in a linux container to authenticate with user/password against a kestrel server with kerberos

I'm developing a Service in ASP.Net-Core (.net6) that connects to a BusinessCentral OData API. The Server has SSL/Kerberos enabled and I have a user and password to authenticate with. I use the AddHttpClient-IServiceCollectionExtension in my Program.cs like:

services.AddHttpClient([name], httpClient =>
{
  httpClient.BaseAddress = new Uri(config[BaseUrl]);
}).ConfigurePrimaryHttpMessageHandler(() =>
  new HttpClientHandler()
  {
    Credentials = new NetworkCredential(
      config[Username],
      config[Password],
      config[Domain])
  }
);

...and inject the IHttpClientFactory to my client-class:

MyODataClient(IHttpClientFactory factory)
{
  _client = factory!.CreateClient([name]);
}

public HttpResponseMessage GetEntity(Entity src)
{
  var path = $"{src.Type}('{src.SysId}')?";
  var request = new HttpRequestMessage(HttpMethod.Get, path);
  var response = _client.SendAsync(request);
  return response;
}

So far so good. Everything ist fine and works (with swagger)! BUT... When I start this service within a linux Docker container, I get the error:

GSSAPI operation failed with error - Unspecified GSS failure. Minor code may provide more information (Cannot find KDC for realm "[domain]").

Then I tried:

builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
builder.Services.AddAuthorization(options =>
{
  options.FallbackPolicy = options.DefaultPolicy;
});

Now Swagger ask me for username and password. It doesn't work but I think this is why I don't passthrough the headers from swagger to BC19... with HeaderPropagation or so (??). Btw. I need to use a static user. No interaction...

I also read and tried keytab-stuff... But everything I read was >2 years old. Does anybody know, how to deal with it in .net6? It seems to be quite easy but I don't find the two lines of code, that I need to connect the httpClientHandler (credentials) with the AuthenticationBuilder (negotiate)

Maybe this log helps:

Authorization failed. These requirements were not met:
DenyAnonymousAuthorizationRequirement: Requires an authenticated user.
[17:20:26 INF] AuthenticationScheme: Negotiate was challenged.
[17:20:26 INF] Request finished HTTP/1.1 GET https://localhost:49179/Entity?[...]. - - - 401 0 - 28.0138ms

best regards

Oli