Earlier quoted context omitted.
No. Create a new user namespace and you have CAP_NET_RAW within your shiny new namespace.
That's pretty interesting. Does it mean it allows escaping Docker containers if you compromise a service ran as root in it?
As a rule of Thumb, an attack can ALWAYS escape from Docker containers.
These containers are a light way to separate processes. They are not intended as a security measure to isolate malicious processes that tries to escape.