QNAP Container Station (docker) cannot open TUN/TAP

Hi. I'm trying to move zerotier from qpkg mode to docker mode.

/dev/net/tun is presented by QVPN.

Here is my compose file in Container Station:

version: '3'
services:
  zerotier:
    image: zerotier/zerotier
    container_name: zerotier-one
    network_mode: host
    environment:
      - ZEROTIER_IDENTITY_PUBLIC=<my public key>
      - ZEROTIER_IDENTITY_SECRET=<my secret key>
    devices:
      - /dev/net/tun
    command: <my network id>
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN

Running log:

=> Configuring networks to join
=> Joining networks from command line: [my network id]
===> Configuring join: [my network id]
=> Starting ZeroTier
===> ZeroTier hasn't started, waiting a second
Starting Control Plane...
Starting V6 Control Plane...
ERROR: unable to configure virtual network port: could not open TUN/TAP device: No such file or directory
=> Writing healthcheck for networks: [my network id]
=> zerotier-cli info: [200 info 1c565c88e2 1.12.2 OFFLINE]
=> Sleeping infinitely

Start by reproducing the supplied compose configuration in QNAP Container Station and verify whether /dev/net/tun is available inside the container with the requested capabilities. Compare the container's device mapping with the QVPN-provided path and confirm the result in the shown ZeroTier startup log; done means the TUN/TAP device opens and ZeroTier reports online.