The reason is that "brctl setfd ..." works fine in an unprivileged container, but libvirt-daemon fails. In other words: brctl shows that it *is* possible to create and manage bridges in an unprivileged container, but libvirt-daemon isn't doing it correctly.
I am currently only using libvirt to create virbr0 (for GNS3) - I'm not running kvm.
It's quite possible that anyone who wants to run kvm would require privileged mode for other reasons, but that would be a separate point.
Sorry, but I still think it's a bug.
The reason is that "brctl setfd ..." works fine in an unprivileged container, but libvirt-daemon fails. In other words: brctl shows that it *is* possible to create and manage bridges in an unprivileged container, but libvirt-daemon isn't doing it correctly.
I am currently only using libvirt to create virbr0 (for GNS3) - I'm not running kvm.
It's quite possible that anyone who wants to run kvm would require privileged mode for other reasons, but that would be a separate point.