In addition to userland Wireguard, we (Tailscale) also increasingly use Google's userland TCP/IP stack (netstack) for platforms that lack kernel facilities we need, when drivers aren't available, or when we lack permissions (e.g. user not running as root, or running as some weirdo root in some container environment).