SOLVED: Issue with needing to run with privileged: true when getting tun errors and failed to start with error 1

[DFC72]

I am using portainer to create a stack (compatible and I believe approximately equivalent to a docker compose file)

I was getting errors and failed starts on the container with exit code 1 related to tun

Some googling mentioned needing to run with elevated privileges so I had to add a line to get it to run.

ie:
version: '3.3'
services:
transmission-openvpn:
privileged: true
cap_add:
- NET_ADMIN
volumes:

It runs now, but I would like to know if I have opened myself up to some security issues?

Also, it seems like this used to run fine previously but I've updated the OS and docker many times since my original build of this container, and I suspect an update has either changed some function, or has broken a dependency or setting somewhere.

Currently running on a Raspberry pi 4B 4GB with Debian GNU/Linux 12 (bookworm)

Docker is version 27.4.1, build b9d17ea

Portainer is BE 2.21.5 LTS

[DFC72]

Ok, solved it here.
Error message I was receiving in the container logs:

ERROR: Cannot open TUN/TAP dev /dev/net/tun: Operation not permitted (errno=1)

What I tried:
Some threads mentioned a bug in the new containerd package, but THIS IS NOT THE CASE.
tun has been removed from default device access from the container by design in 1.7.24-1
There is a hack fix by downgrading containerd from version 1.7.24-1 to the previous 1.7.23-1
This absolutely works, but will get overwritten on next APT update unless you do a apt-mark hold on the earlier version.

Another way is to elevate privileges for the container by adding --privileged to the run line or adding - privileged: true to the docker compose file.

Most do not recommend this due to potential security risks with a container having that level of access.

What I did in order:
Tried privileged: true in my docker compose file(WORKED)
Tried downgrading containerd to 1.7.23-1 and removing the privileged setting (WORKED)

Recommended resolution:
I edited my docker compose file as follows:
services:
transmission-openvpn:
devices:
- /dev/net/tun:/dev/net/tun
cap_add:
- NET_ADMIN

Then upgraded the containerd to latest (1.7.24-1 as of time of writing this)
Restarted docker
sudo systemctl restart docker

Everything works now, with no elevated privileges and no errors.