Sibling Denied, Grandchild Allowed: Who ptrace_scope=1 Stops

Summary

Same two lines, two machines. On Docker Desktop on my Mac I step into an Alpine container, run sleep 30 & and then strace -p $!: "Process 10 attached". On an Ubuntu 26.04 server, a container from the same image, the same two commands: strace: attach: ptrace(PTRACE_SEIZE, 11): Operation not permitted. Same user, same capability set (CapEff: 00000000a80425fb on both sides), same seccomp profile. The difference is not in the container but in the kernel underneath: linuxkit 6.10.14's LSM list...