With PVE 6.4, I had functional tun/tap (think ZeroTier) inside privileged LXC with the following config:
lxc.cgroup.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
In PVE 7, with or without features: mknod=1, ZeroTier now fails:
zerotier-one[171]...