From 0c06a641cbf8c48897ac114efecc0f7c88affcda Mon Sep 17 00:00:00 2001
From: Kristoffer Dalby <kristoffer@tailscale.com>
Date: Mon, 9 Dec 2024 13:15:30 +0100
Subject: [PATCH] mount devnettun

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
---
 integration/scenario.go  |  8 ++++----
 integration/tsic/tsic.go | 16 ++++++++++------
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/integration/scenario.go b/integration/scenario.go
index ad740b8cb61..eb215d6af35 100644
--- a/integration/scenario.go
+++ b/integration/scenario.go
@@ -53,10 +53,10 @@ var (
 	// Tailscale started adding TS2021 support in CapabilityVersion>=28 (v1.24.0), but
 	// proper support in Headscale was only added for CapabilityVersion>=39 clients (v1.30.0).
 	tailscaleVersions2021 = map[string]bool{
-		"head":     false,
-		"unstable": false,
-		"1.74":     false, // CapVer: 106
-		"1.72":     false, // CapVer: 104
+		"head":     true,
+		"unstable": true,
+		"1.74":     true,  // CapVer: 106
+		"1.72":     true,  // CapVer: 104
 		"1.70":     true,  // CapVer: 102
 		"1.68":     true,  // CapVer: 97
 		"1.66":     true,  // CapVer: 95
diff --git a/integration/tsic/tsic.go b/integration/tsic/tsic.go
index 4436b81bec8..e28f119699d 100644
--- a/integration/tsic/tsic.go
+++ b/integration/tsic/tsic.go
@@ -236,15 +236,19 @@ func New(
 	}
 
 	tailscaleOptions := &dockertest.RunOptions{
-		Name:     hostname,
-		Networks: []*dockertest.Network{tsic.network},
-		// Cmd: []string{
-		// 	"tailscaled", "--tun=tsdev",
-		// },
+		Name:       hostname,
+		Networks:   []*dockertest.Network{tsic.network},
 		Entrypoint: tsic.withEntrypoint,
 		ExtraHosts: tsic.withExtraHosts,
 		Env:        []string{},
-		CapAdd:     []string{"NET_ADMIN", "NET_RAW"},
+
+		// Needed since containerd (1.7.24)
+		// https://github.com/tailscale/tailscale/issues/14256
+		// https://github.com/opencontainers/runc/commit/2ce40b6ad72b4bd4391380cafc5ef1bad1fa0b31
+		CapAdd: []string{"NET_ADMIN", "NET_RAW"},
+		Mounts: []string{
+			"/dev/net/tun:/dev/net/tun",
+		},
 	}
 
 	if tsic.withWebsocketDERP {