Use userspace overlay forwarding when containers lack TUN
A container without a network tunnel device can still accept private overlay traffic by running the overlay daemon in userspace mode and configuring its built-in TCP service proxy to forward a tailnet port to loopback. Bind the application only to loopback, publish no public appl…