UPDATE: This does NOT work. The build still failed and it only updated the timestamp of the existing image.
Found a solution:
Create a hooks/build
file with the following contents:
#!/bin/bash
docker build -f "$DOCKERFILE_PATH" -t "$IMAGE_NAME" .
docker push "$IMAGE_NAME"
(Details about hooks: https://docs.docker.com/docker-hub/builds/advanced/)
I suspect that by default Docker Hub now builds with some --cap-drop=
which probably caused the issue.