Runs a Tailscale node inside a container, advertising subnet routes and acting as an exit node for your tailnet.
https://tailscale.com/docs/features/containers/docker
| Setting | Value |
|---|---|
| Image | tailscale/tailscale:latest |
| Network mode | Dedicated Docker bridge network with net_admin + /dev/net/tun |
| Exit node | Enabled (--advertise-exit-node) |
| Subnet routes | 10.0.0.0/20 (configurable) |
| State | /mnt/SSD/Containers/tailscale |
- A Tailscale account and tailnet
- An auth key from the Tailscale admin console
/dev/net/tunavailable on the host (standard on Linux)- Upstream DNS servers
10.0.6.2and10.0.6.3reachable from the Docker host, or adjust thedns:entries incompose.yaml
cp .env.example .envnano .env| Variable | Required | Description |
|---|---|---|
TS_AUTHKEY |
Yes | Auth key from the Tailscale admin console |
TS_HOSTNAME |
No | Node name in the admin console (default: homelab) |
TS_EXTRA_ARGS |
No | Extra flags passed to tailscale up |
TS_ROUTES |
No | Subnet routes to advertise (default: 10.0.0.0/20) |
mkdir -p /mnt/SSD/Containers/tailscaledocker compose up -dAfter the first successful connection, go to the Tailscale admin console, find the node, and approve the advertised subnet routes.
| Type | When to use |
|---|---|
| Reusable auth key | Simple setup; node registered under your user account |
| OAuth client secret | Preferred for long-running containers; does not expire |
Generate keys at login.tailscale.com/admin/settings/keys.
This container advertises itself as a Tailscale exit node. To use it, select it in the Tailscale client on any device in your tailnet under Use exit node.
| Data | Path |
|---|---|
| Tailscale state | /mnt/SSD/Containers/tailscale |
State includes the node key and registration — preserving it avoids re-authentication on container restarts.
docker compose pull
docker compose up -dIf the node loses authentication, delete the state directory and redeploy:
docker compose down
rm -rf /mnt/SSD/Containers/tailscale/*
docker compose up -d