A kernel Macvlan shim (virtual bridge) is used to resolve the issue of the host and containers being unable to communicate directly, and to allow VPN traffic to be routed to containers.