So Tailscale has this whole series about hosting services on one’s Tailnet using Docker. Their approach is to run Tailscale in Docker and have the services’ containers share its namespace by setting network_mode: service:<tailscale_service_name>.
I am trying to understand why this is better than just binding the service’s port to the Tailscale IP of the host device, given that option is not even mentioned in any of their blog posts.
The only advantage I can think of is that you get to have different Tailscale rules/configurations for different services. In my case, this is not an advantage because I will run Tailscale on the host anyway and I won’t have different configurations for each service.
Can anyone help me understand?
If tailscale inside a container allows you to talk to it via “direct” connection and not a derp proxy, then it will offer you better service isolation (can set the tailscale ACLs for this specific service) without sacrificing performance.
Tailscale pushes for it because it just ties you in more. It allows to to utilize the ACLs better, to see your thing in their service mesh, and every service will count against the free node limit.
In practice, I often do both. E.g. I’ll have my http ingress exposed to tailscale and route a bunch of different services through it at a single tailscale node, where the access control is done by services individually. But I’ll also run a pod-to-pod tailscale between two k8s clusters because tailscale ACL is just convenient.
From my experience with tailscale so far - there are so many different ways to have it configured well. If it works well for you having it on the host, then go for it. I have home assistant in a VM with tailscale and tailscale on the (windows) host. This works well for my needs and I don’t mind having it running “twice”
I’m just curious if I’m missing something and to learn the best practice as well as the reason why it’s the best practice.
I only have experience trying to run two Tailscale containers on the same machine and hit so many roadblocks that running it containerized just wasn’t worth it.
Containerizing is probably only worth it if you have an explicit need for it.
Does the tailscale IP of the host change?
Maybe you get the possibility of routing all traffic from a container (or all the containers in that namespace/network) over the tailnet this way? With the host method, you’d need the host to use the exit node too.
I was hable to include the taislcale image inside every composer of the web apps I’m using in Docket and have their own magic dns and ip. Even turn on funnel from inside the container and get endcription to the internet direct access. There is a guide https://tailscale.com/kb/1282/docker/
