This is the exact and complete error message:

man: error while loading shared libraries: /lib/x86_64-linux-gnu/libc.so.6: cannot apply additional memory protection after relocation: Permission denied

I think, it has something to do with the kernel update, my Ubuntu 22.04 got today. It uses kernel 6.8.0-40-generic now.

$ uname -a
Linux Jellyfish 6.8.0-40-generic #40~22.04.3-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 30 17:30:19 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Before the update, I used the kernel 6.5.0-45-generic.
I can execute man without problems in the same docker container, in which I got the error above, when I’m booting into the old kernel 6.5.0-45-generic. That is despite the fact that I built the image and ran the container for the first time when using the new kernel 6.8.0-40-generic.

This is my Dockerfile:

FROM kalilinux/kali-rolling:latest

ENV TZ="Europe/Berlin"
ENV DEBIAN_FRONTEND=noninteractive
ENV TERM=xterm-256color

# Install Kali Full
RUN rm -fR /var/lib/apt/ && 
    apt-get clean && 
    apt-get update && 
    apt-get install -y ca-certificates && 
    apt-get install -y software-properties-common kali-linux-headless --fix-missing && 
    echo 'VERSION_CODENAME=kali-rolling' >> /etc/os-release

# Add NodeJS repo
RUN curl -sL https://deb.nodesource.com/setup_lts.x | bash -

# Some system tools
RUN apt-get install -y openvpn iputils-ping man-db git colordiff colortail unzip vim tmux xterm zsh wget curl telnet strace ltrace tmate less build-essential python3-setuptools python3-pip tor proxychains proxychains4 zstd net-tools bash-completion iputils-tracepath nodejs

COPY ./lab_kzi.ovpn /home/

CMD ["bash", "-c", "openvpn /home/lab_kzi.ovpn >& /dev/null & exec bash"]

WORKDIR /home/

I also use a docker-compose.yml file:

version: '3'
services:
  htbcontainer:
    image: hackthebox_lab
    privileged: true
    cap_add:
      - NET_ADMIN
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=0
    stdin_open: true
    tty: true

I started the container the first time with docker-compose run -i htbcontainer. For later uses I usually use the same container and start it with docker start -i hackthebox-htbcontainer-run-a8e9b92d76dc, or whatever the given container-name is.