For the record: debugging (and also strace) need the CAP_PTRACE capability. The problem was solved by running the container with --privileged.
strace
CAP_PTRACE
--privileged