I thought it used to work with unpriviledged containers, that was what the bind mount was for: use the tun device node from host, because unpriviledged containers can't create device nodes...
from here I guess that the syntax for bind mounts may have changed, thus the line
lxc.mount.entry...