Actually, that getcap/setcap doesn't seem to matter (red herring). I have an openvz box that started off with 3.3 or earlier and was upgraded to v4. It continued to work.
Today, I reinstalled centos 7 on that VPS that was previously working on v4. Since the installer doesn't support openvz, the script failed part way through. While looking at what to edit in the basic-install.sh (ie, don't call setStaticIPv4()) , I thought I could just put the correct parameters in the setupVars.conf and try for an automated install and skip the bad setting static IP code.
Well, the automated install finished, but ran into the problem where DNS doesn't start and I'm getting "-bash: /usr/bin/pihole-FTL: Operation not permitted".
So I do think that a fresh install of v4 is doing something new/different than an install of v3.3 upgraded to v4.
Edit: Actually, it does look like the capabilities. If I run your pihole-FTL-linux-x86_64 in /usr/bin, then it starts. But if I reboot, something is setting the caps again and breaks it. So that might be why other users might not have had success.
I would expect the setcap to happen during install, one time, not during service start. That just seems wrong place.
But ugh, I think I'll need to figure out how to get a working older version and just leave it at that. Just sucks that installing and using pihole has only gotten more difficult over time instead of easier. But I guess that comes with adding more features.