aha, I think this is the winner! I had installed mongodump on the host machine via the Ubuntu mongo-tools package, and mongodump --version unhelpfully reports built-without-version-string.
So I copied the mongodump binary out of the docker container and tried running it on the host, and the backup then worked fine. Mystery solved!
Thanks Chris!