Base image for applications - you should never need to pull this yourself. Containers need rebuilt with additional arguments: --cap-add=NET_ADMIN --device /dev/net/tun:/dev/net/tun