Error when creating a network namespace inside a docker container. error: mount --make-shared /run/netns failed: Permission denied

The other answer suggests adding --privileged, but note that adding --privileged effectively removes all security features. If you are uncomfortable with this, you might prefer an approach that gives the container access only to what it needs.

The root cause is that Docker's default apparmor profile contains the rule deny mount which prevents mount from working inside Docker containers, which is what is causing the error message mount --make-shared /run/netns failed: Permission denied.

You can confirm this by adding --security-opt apparmor=unconfined to your command, which disables apparmor, and notice that the mount command succeeds.

docker run -it --rm --name=ubuntu \
  --cap-add CAP_SYS_ADMIN --cap-add NET_ADMIN \
  --security-opt apparmor=unconfined \
  ubuntu
apt-get update && apt-get install -y net-tools iproute2
ip netns add red # succeeds

If you don't want to fully opt out of apparmor, you can create a custom apparmor profile, then load it with apparmor_parser -r -W path/to/your/profile and then load it with --security-opt apparmor=your-profile-name. You can create a custom apparmor profile by copying Docker's template and then tweaking it to suit your needs.

At the time of writing, Docker does not have an easy way to show the apparmor profile it is currently using, but you can look at the source template and then expand the template manually (by following the template logic).

See https://docs.docker.com/engine/security/apparmor/

--cap-add & --privileged are not same.
Ref: https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

Issue is sorted by running the container with privilege. Capabilities seems not required for adding network namespace.

docker run -d --name=<name> --network=none --privileged <image>:<tag>