Use userspace overlay forwarding when containers lack TUN

A container without a network tunnel device can still accept private overlay traffic by running the overlay daemon in userspace mode and configuring its built-in TCP service proxy to forward a tailnet port to loopback. Bind the application only to loopback, publish no public application port, and validate reachability from another overlay member before changing an upstream target. This preserves private service-to-service routing without requiring privileged container capabilities. It does not replace normal tunnel mode when subnet routing or transparent outbound networking is required.

Applies when: A hosted container lacks a TUN device but needs private inbound service access. Keywords: userspace networking no tun private tcp proxy container