We had a topic about this in the past: Adding capabilities to containers running as non-root users - #2 by matinats
I didn’t test it myself.
The pihole image seem to implement a solution for it. You could study it and find out how they do it: https://github.com/pi-hole/docker-pi-hole?tab=readme-ov-file#note-on-capabilities.