diff --git a/c/vpnkit-tap-vsockd/Dockerfile b/c/vpnkit-tap-vsockd/Dockerfile
index e34f36e44..b239ce635 100644
--- a/c/vpnkit-tap-vsockd/Dockerfile
+++ b/c/vpnkit-tap-vsockd/Dockerfile
@@ -1,11 +1,11 @@
-FROM alpine:3.8 as build
+FROM alpine:3.15 as build
 RUN apk add --no-cache musl-dev build-base linux-headers
 
 COPY . /build
 RUN make -C /build sbin/vpnkit-tap-vsockd
 
 # Using alpine rather than scratch allows us to support post-up scripts
-FROM alpine:3.8
+FROM alpine:3.15
 RUN apk add dhclient
 COPY --from=build /build/sbin/vpnkit-tap-vsockd /sbin/vpnkit-tap-vsockd
 CMD [ "/sbin/vpnkit-tap-vsockd", "--tap", "eth0", "--message-size", "8192", "--buffer-size", "262144", "--path", "/run/host-services/vpnkit.sock" ]
diff --git a/c/vpnkit-tap-vsockd/build.yml b/c/vpnkit-tap-vsockd/build.yml
new file mode 100644
index 000000000..1d8a64c39
--- /dev/null
+++ b/c/vpnkit-tap-vsockd/build.yml
@@ -0,0 +1,10 @@
+image: vpnkit-tap-vsockd
+config:
+  capabilities:
+    - CAP_NET_ADMIN
+  devices:
+    - path: "/dev/net/tun"
+      type: c
+      major: 10
+      minor: 200
+      mode: 0666