@jserowoky Is SELinux enabled or disabled? Run getenforce and post output here.
Change access rights on the folders (chmod 775 /images /images/dev) and try capturing again.
In /images/dev the temp folder appears using a random alphanumeric name, which I’m assuming is normal.
Yes, we use the MAC address (without colon or hyphen notation) as temporary folder name in /images/dev.