Due to a recent containerd 1.7.24 update, your /dev/net/tun:/dev/net/tun mapping needs to be moved from the volumes section to the devices section.

Don’t be like me and realize this AFTER you leave home for the holidays.