containers:
        - name: net
          image: nath:1
          securityContext:
            capabilities:
              add: # 添加
              - NET_ADMIN

      containers:
        - name: net
          image: nath:1
          securityContext:
            privileged: true
          args: ["--device","/dev/tun"]