Portainer Templates logo

Portainer Templates

Tailscale (container) Tailscale (container)

OtherVPN

Connect your devices and users together in your own secure Zero config virtual private network.

Image details

Pulls: 159.3M
Architecture: amd64, arm64, arm/v7, 386
Image size: 54 MB
Latest: v1.102.2
User: tailscale
Created: Apr 14, 2020
Updated: 3 days ago
Status: active

Source details

Repo: tailscale/tailscale
Stars: 35.2k
Forks: 3k
Language: Go
License: BSD-3-Clause
Latest: v1.102.2 · 11 days ago
Updated: 5 hours ago
Website: tailscale.com/

Configuration

Type
Container
Platform
linux
Image
tailscale/tailscale:stable
Command
tailscale up --authkey=$AUTH_KEY
Volumes
/var/lib/tailscale : /portainer/Files/AppData/Config/tailscale/dev/net/tun : /dev/net/tun
Env vars
AUTH_KEY=
Restart
unless-stopped

Template by novaspirit

Notes

Template created by Pi-Hosted Series
Check our Github page: https://github.com/pi-hosted/pi-hosted

Official Webpage: https://tailscale.com/
Official Docker Documentation: https://hub.docker.com/r/tailscale/tailscale


Standalone Install

Select an install method, to see config/commands for deploying Tailscale (container)

Installation method

Install on Portainer

Import all app templates into your Portainer instance, for easy 1-click deploys

  1. Ensure both Docker and Portainer are installed, and up-to-date
  2. Log into your Portainer web UI
  3. Under Settings → App Templates, paste the below URL
  4. Head to Home → App Templates, and the list of apps will show up
  5. Select Tailscale (container), fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json
Show Me demo

More install options in our documentation, or see tailscale/tailscale for app-specific guidance.

docker pull tailscale/tailscale:stable

Quick reference

  • Maintained by: Tailscale
  • Where to get help: Tailscale support
  • Where to file issues: https://github.com/tailscale/tailscale/issues
  • Supported architectures: arm, arm64, amd64, 386

Supported tags

Containers are tagged based on the Tailscale Versioning scheme.
  • stable, latest to get the latest stable version.
+ v1.20.1, v1.20 to get a specific stable version.
  • unstable to get the latest unstable version.
+ unstable-v1.33.159, unstable-v1.33 to get a specific unstable version.

What is Tailscale?

Tailscale lets you connect your devices and users together in your own secure virtual private network. Tailscale enables encrypted point-to-point connections using the open source WireGuard protocol.
Read more about Tailscale and what you can do with Tailscale in containers.

How to use this image

This image includes all the Tailscale binaries.
To build the Dockerfile:
docker build -t tailscale/tailscale .

To run the tailscaled agent:
docker run -d --name=tailscaled -v /var/lib:/var/lib -v /dev/net/tun:/dev/net/tun --network=host --cap-add=NET_ADMIN --cap-add=NET_RAW tailscale/tailscale

We recommend you use an auth key for an ephemeral node when using Tailscale in a container, which can be accomplished by passing in a TSAUTHKEY environment variable:
docker run -d --name=tailscaled -v /var/lib:/var/lib -v /dev/net/tun:/dev/net/tun --network=host --cap-add=NET_ADMIN --cap-add=NET_RAW --env TS_AUTHKEY=tskey-auth-ab1CDE2CNTRL-0123456789abcdef tailscale/tailscale

To see status:
docker exec tailscaled tailscale --socket /tmp/tailscaled.sock status

Parameters

  • TS_ACCEPT_DNS: Accept DNS configuration from the admin console. Not accepted by default.
  • TS_AUTH_ONCE: Attempt to log in only if not already logged in. False by default, to forcibly log in every time the container starts.
  • TS_AUTHKEY: A Tailscale auth key used to authenticate the container.
  • TS_DEST_IP: Proxy all incoming Tailscale traffic to the specified destination IP.
  • TS_KUBE_SECRET: If running in Kubernetes, the Kubernetes secret name where Tailscale state is stored. The default is tailscale.
  • TS_HOSTNAME: Use the specified hostname for the node.
  • TS_OUTBOUND_HTTP_PROXY_LISTEN: Set an address and port for the HTTP proxy.
  • TS_ROUTES: Advertises subnet routes. Equivalent to tailscale set --advertise-routes=. To accept advertised routes, use TS_EXTRA_ARGS to pass in --accept-routes.
  • TS_SOCKET: Unix socket path used by the Tailscale binary, where the tailscaled LocalAPI socket is created. The default is /var/run/tailscale/tailscaled.sock.
  • TS_SOCKS5_SERVER: Set an address and port for the SOCKS5 proxy.
  • TS_STATE_DIR: Directory where the state of tailscaled is stored. This needs to persist across container restarts.
  • TS_USERSPACE: Enable userspace networking, instead of kernel networking. Enabled by default.

Extra arguments:
  • TS_EXTRA_ARGS: any other CLI flags for tailscale set
  • TS_TAILSCALED_EXTRA_ARGS: any other flags for tailscaled

For reference, see also the Tailscale documentation for this image.

Frequently Asked Questions

Why do I get a new IP address every time the container restarts?

The most common uses for containers are dynamic, where containers come and go depending on load. By default tailscaled stores its state in /tmp and expects to be an ephemeral node.
To support a long-lived service where the container retains its settings and identity across restarts, several things need to be done:
  • The container must be provided with persistent storage, such as -v /var/lib/tailscale:/var/lib/tailscale
  • Set TSSTATEDIR to the location where the persistent storage has been mounted, like -e TS_STATE_DIR=/var/lib/tailscale

Why do incoming connections work but not outgoing?

To support any arbitrary process using Linux sockets, tailscaled needs access to a /dev/net/tun device which many containers do not provide. By default the Dockerfile runs in userspace-networking mode, where incoming connections over the Wireguard tunnel are forwarded to the same port on localhost but initiating new connections would require SOCKS5 or HTTP proxies to be used.
To support outgoing connections from any socket application:
  • The container must be provided with a TUN device, such as -d /dev/net/tun:/dev/net/tun
  • TS_USERSPACE must be set to false, such as -e TS_USERSPACE=0

License

See license information.

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

  • In Portainer, go to Containers, click the container, then Logs. Or run docker logs tailscale
  • Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Permission denied on volumes

If the logs show "permission denied", the app can't write to its data folder on the host.

  • Fix the ownership: sudo chown -R 1000:1000 /portainer/Files/AppData/Config/tailscale (and the same for the other mapped folders)

Image won't pull

Test the pull directly on the host: docker pull tailscale/tailscale:stable

  • "manifest unknown" means the tag no longer exists.
  • "toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
  • "no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

  • This image supports: amd64, arm64, arm/v7, 386
  • Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Container keeps restarting

The unless-stopped restart policy relaunches the app after every crash, so the real error can scroll past.

  • Check the logs right after a restart, the last few lines before it died are the useful ones.
  • Get the exit code with docker inspect tailscale --format '{{.State.ExitCode}}'
  • Still stuck? Redeploy once with the restart policy set to no so the failure stays visible.

Required settings are blank

AUTH_KEY has no default value, and tailscale may crash or misbehave if left empty.

  • Fill it in on the deploy screen before hitting deploy.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

A single container

Tailscale (container) runs as one container, the simplest kind of app here. Just the one image to pull and nothing else wired up alongside it.

The app image

An image is the app packed up ready to go, everything Tailscale (container) needs bundled into one download. This template pulls tailscale/tailscale:stable, which Docker fetches once (about 54 MB) and then starts your own copy from.

Where the image comes from

Docker pulls its images from registries, public libraries of ready-built apps. Tailscale (container)'s comes from Docker Hub, published by tailscale.

Version tags

The bit after the colon in the image name is the version tag. This one pins stable, so every redeploy gives you that exact build until you bump it yourself.

Which machines it runs on

Every image is built for particular CPU types. This one ships for amd64, arm64, arm/v7, 386, so it runs on both regular x86 servers and ARM boards like a Raspberry Pi.

Volumes

A volume is where Tailscale (container) keeps its files so they survive an update or a restart. Without one, anything it saves would sit inside the container and vanish the moment it's recreated. This template mounts:

  • /var/lib/tailscale from /portainer/Files/AppData/Config/tailscale on the host
  • /dev/net/tun from /dev/net/tun on the host

Environment variables

Environment variables are the settings you hand over when you deploy, things like a password or a timezone. Tailscale (container) takes 1 of them, and one needs a value before it'll start properly:

  • AUTH_KEY, needs a value. Get AUTH KEY from your tailscale.com user panel

Restart policy

The restart policy here is unless-stopped, so Docker restarts Tailscale (container) after a crash or reboot, but leaves it off when you stop it on purpose. You can change this on the deploy screen. The choices are no (never restart), on-failure (only after a crash), unless-stopped (restart unless you stop it), and always (bring it back no matter what).

Networking

Nothing custom is set, so Tailscale (container) sits on Docker's default bridge network: its own private space that reaches the outside world only through the ports it publishes.

Container name

Once it's deployed, Portainer names the container tailscale. That's what you'll spot in the containers list and use in commands like docker logs tailscale.

Startup command

The command is what runs the moment the container starts. This template sets its own, tailscale up --authkey=$AUTH_KEY, in place of the image's default.

Platform

The platform is linux, the kind of system the container is built to run on. Docker and Portainer handle this on a normal Linux server.

Open source license

Tailscale (container) is open source, released under the BSD-3-Clause license. In plain terms the code is out in the open, so you're free to run it and change it to fit what you need.

Portainer app templates

Zooming out, this whole page comes from a Portainer app template: a short recipe telling Portainer how to set Tailscale (container) up. Add the template list to Portainer once, then deploying Tailscale (container) is a click rather than a wall of config.