[raggi]

fwiw, you technically don't need a privileged container to use tun, you just need suitable permissions on the kernel tun interfaces.