capabilities not working

gistfile1.txt

rkt image cat-manifest quay.io/coreos/flannel
{
	"acKind": "ImageManifest",
	"acVersion": "0.8.4",
	"name": "quay.io/coreos/flannel",
	"labels": [
		{
			"name": "arch",
			"value": "amd64"
		},
		{
			"name": "os",
			"value": "linux"
		}
	],
	"app": {
		"exec": [
			"/opt/bin/flanneld"
		],
		"user": "0",
		"group": "0",
		"mountPoints": [
			{
				"name": "run-flannel",
				"path": "/run/flannel"
			},
			{
				"name": "etc-ssl-etcd",
				"path": "/etc/ssl/etcd",
				"readOnly": true
			},
			{
				"name": "dev-net",
				"path": "/dev/net"
			}
		],
		"isolators": [
			{
				"name": "os/linux/capabilities-retain-set",
				"value": {
					"set": [
						"CAP_NET_ADMIN"
					]
				}
			}
		]
	},
	"annotations": [
		{
			"name": "appc.io/acbuild/command-1",
			"value": "acbuild set-name \"quay.io/coreos/flannel\""
		},
		{
			"name": "appc.io/acbuild/command-2",
			"value": "acbuild dependency add \"quay.io/coreos/flannelbox:1.0\""
		},
		{
			"name": "appc.io/acbuild/command-3",
			"value": "acbuild mount add \"run-flannel\" \"/run/flannel\""
		},
		{
			"name": "appc.io/acbuild/command-4",
			"value": "acbuild mount add \"etc-ssl-etcd\" \"/etc/ssl/etcd\""
		},
		{
			"name": "appc.io/acbuild/command-5",
			"value": "acbuild mount add \"dev-net\" \"/dev/net\""
		},
		{
			"name": "appc.io/acbuild/command-6",
			"value": "acbuild copy \"../artifacts/flanneld\" \"/opt/bin/flanneld\""
		},
		{
			"name": "appc.io/acbuild/command-7",
			"value": "acbuild set-exec \"/opt/bin/flanneld\""
		},
		{
			"name": "appc.io/acbuild/command-8",
			"value": "acbuild isolator add \"os/linux/capabilities-retain-set\" \"-\""
		}
	],
	"dependencies": [
		{
			"imageName": "quay.io/coreos/flannelbox",
			"labels": [
				{
					"name": "version",
					"value": "1.0"
				}
			]
		}
	]
}