Why does mounting this ext4 image fail?

Question

I'm learning about Linux filesystems, and am trying to follow instructions how to create a ext4 image, mount it to a directory, and run debootstrap in that mounted directory.

Step 1 of my instructions is simply docker run -it ubuntu.
The remainder of the instructions are meant to be run in the running container:

output_file="output.ext4"
OUTPUT_DIR="/output"
OUTPUT_FILE_PATH="${OUTPUT_DIR}/${output_file}"
ROOTFS_DIR="/rootfs"
mkdir -p "${OUTPUT_DIR}"
truncate -s 4G "${OUTPUT_FILE_PATH}"
mkfs.ext4 "${OUTPUT_FILE_PATH}"
mkdir -p "${ROOTFS_DIR}"
mount "${OUTPUT_FILE_PATH}" "${ROOTFS_DIR}"

The mount fails:

$ docker run -it ubuntu
root@1397d90526b0:/# output_file="output.ext4"
root@1397d90526b0:/# OUTPUT_DIR="/output"
root@1397d90526b0:/# OUTPUT_FILE_PATH="${OUTPUT_DIR}/${output_file}"
root@1397d90526b0:/# ROOTFS_DIR="/rootfs"
root@1397d90526b0:/# mkdir -p "${OUTPUT_DIR}"
root@1397d90526b0:/# truncate -s 4G "${OUTPUT_FILE_PATH}"
root@1397d90526b0:/# mkfs.ext4 "${OUTPUT_FILE_PATH}"
mke2fs 1.45.5 (07-Jan-2020)
Discarding device blocks: done
Creating filesystem with 1048576 4k blocks and 262144 inodes
Filesystem UUID: 43049653-4659-4a98-bc6e-407f182905db
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736

Allocating group tables: done
Writing inode tables: done
Creating journal (16384 blocks): done
Writing superblocks and filesystem accounting information: done

root@1397d90526b0:/# mkdir -p "${ROOTFS_DIR}"
root@1397d90526b0:/# mount "${OUTPUT_FILE_PATH}" "${ROOTFS_DIR}"
mount: /rootfs: mount failed: Operation not permitted.
root@1397d90526b0:/#

Question: why does the mount fail, and what can I do to resolve it?
My instructions carry forth with various other commands like debootstrap and make no mention of the possibility of a mount failure.

Answer 1

@A.B clued me in to the notion of privilege restriction here.

What worked (and what was omitted from my instructions) was that the docker container should be run in privileged mode.

I.e. docker run -it --privileged ubuntu, followed by the same steps as in the original post, allows success of the mount "${OUTPUT_FILE_PATH}" "${ROOTFS_DIR}" command.