Containers are great to keep OS separate from apps, but VPN seems pretty integral to OS, so I don’t see an issue using rpm-ostree. Containers often prove challenging because of not being able to get permission or share data between apps ( on purpose )