Other Netbird peers connect fine, so the server and 51820/udp are OK -- the hang is specific to the Gitea runner. Replace the UDP port probes with runner-side checks: /dev/net/tun presence, effective capabilities (NET_ADMIN), WireGuard tooling/module, and a definitive 'ip tuntap add' test. A runner container lacking TUN/NET_ADMIN cannot create the WireGuard interface, which explains 'netbird up' timing out after the control plane connects.