In doubt, look at the systemd source code and you shall find. (the capabilitites systemd-networkd needs to run in a @docker container.)