Thanks for pointing me to the “hidden” configuration, capabilities are now editable and working. 
Went further with a first test (wg-easy - WireGuard) and hit a real blocker: it needs actual NET_ADMIN/iptables access, which only works in rootful mode. Switched the container to rootful, and the import then failed with:
netavark: error while applying dns entries: IO error: aardvark-dns failed to start
Error starting server failed to bind udp listener on 10.89.0.1:53: IO error: Address already in use (os error 98)
Turns out my server runs BIND for DNS zones (default/standard with Virtualmin), and it’s listening on all interfaces including every bridge Podman creates. In rootful mode, aardvark-dns also wants port 53 on its new bridge and loses the race. Digging around, this appears to be a known upstream Podman limitation (containers/podman#15452 among others). Podman’s own docs confirm there’s no way to run aardvark-dns on a non-standard port yet, and the fix is to bind the host DNS server to specific IPs instead of “any”.
To be clear, this only bit me on the one service that needed rootful (real network/iptables access). My earlier phpBB test import, fully rootless, worked without any DNS conflict at all. So this isn’t a “every import breaks” issue. It’s specific to services that need rootful mode for kernel-level networking, which I’d guess is a minority case (VPNs, reverse proxies doing their own iptables, that kind of thing).
Have you run into this with Virtualmin + BIND + rootful containers? Curious if there’s a known-good way to configure BIND’s listen-on around it, since I’d guess anyone running Virtualmin’s default DNS alongside a rootful import that needs its own network will hit the same wall.
Two more small things while I was in there:
1. False “unsaved changes” warning on save
Saving changes under Module Config → “Privileged and host access” and “Container list columns” (User interface settings) triggers the browser’s “leave page / changes won’t be saved” warning — but the save actually goes through fine. A bit confusing since it implies the save might have failed.
2. Raw HTML tags in Runtime mode selector
On “Import Compose Stack” → “Import Behavior”, the Runtime mode dropdown shows literal tags instead of rendering them: Domain user (<tt>rootful</tt>) instead of formatted “rootful”. Looks like the <tt> isn’t being stripped in that select element.
Happy to share screenshots or logs for any of these.