--allow-privileged=true
for the kubelet, and I assume they are all like that. Double check that option is set for the API service
sudo /usr/bin/docker run --rm -v /opt/bin:/opt/bin quay.io/coffeepac/ceph-install
/usr/bin/docker run --rm -v /opt/bin:/opt/bin ceph/install-utils