Not wanting to fight that, I gave up and just switched to using a VM. And then I could use the kernel module that's infinitely easier to configure.

I couldn't convert the other container to a privileged one, or a VM, because it's already filling a role as a Samba server.