The magic here is -cap-add=NET_ADMIN --device /dev/net/tun --net=host, which grants the container enough privileges to set up the tun devices, and makes it visible in the host’s networking stack. (http://nie.gr/2016/04/04/coreos-openvpn/http://nie.gr/2016/04/04/coreos-openvpn/)