Portainer Templates logo

Portainer Templates

Tailscale (stack) Tailscale (stack)

NetworkVPN

Tailscale lets you easily manage access to private resources, quickly SSH into devices on your network, and work securely from anywhere in the world.

Image details

Pulls: 159.3M
Architecture: amd64, arm64, arm/v7, 386
Image size: 54 MB
Latest: v1.102.2
User: tailscale
Created: Apr 14, 2020
Updated: 3 days ago
Status: active

Source details

Repo: tailscale/tailscale
Stars: 35.2k
Forks: 3k
Language: Go
License: BSD-3-Clause
Latest: v1.102.2 · 11 days ago
Updated: 4 hours ago
Website: tailscale.com/

Configuration

Type
Compose
Platform
linux
Image
tailscale/tailscale:latest
Command
tailscaled
Volumes
/var/lib : /portainer/Files/AppData/Config/tailscale/dev/net/tun : /dev/net/tun
Restart
unless-stopped
Source
Repo

Template by xneo1·Source

Standalone Install

Select an install method, to see config/commands for deploying Tailscale (stack)

Installation method

Install on Portainer

Import all app templates into your Portainer instance, for easy 1-click deploys

  1. Ensure both Docker and Portainer are installed, and up-to-date
  2. Log into your Portainer web UI
  3. Under Settings → App Templates, paste the below URL
  4. Head to Home → App Templates, and the list of apps will show up
  5. Select Tailscale (stack), fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json
Show Me demo
Original stackfile

The compose file this template deploys, straight from its repo:

services:
  tailscale:
      hostname: tailscale                                          # This will become the tailscale device name
      container_name: tailscale
      image: tailscale/tailscale:latest
      network_mode: host
      volumes:
          - /portainer/Files/AppData/Config/tailscale:/var/lib        # State data will be stored in this directory
          - /dev/net/tun:/dev/net/tun                      # Required for tailscale to work
      cap_add:                                             # Required for tailscale to work
        - net_admin
        - sys_module
      command: tailscaled
      restart: unless-stopped

Or deploy it directly from the source:

git clone https://github.com/xneo1/portainer_templates
cd portainer_templates
docker compose -f Template/Stack/tailscale.yml up -d

More install options in our documentation, or see tailscale/tailscale for app-specific guidance.

docker pull tailscale/tailscale:stable

Quick reference

  • Maintained by: Tailscale
  • Where to get help: Tailscale support
  • Where to file issues: https://github.com/tailscale/tailscale/issues
  • Supported architectures: arm, arm64, amd64, 386

Supported tags

Containers are tagged based on the Tailscale Versioning scheme.
  • stable, latest to get the latest stable version.
+ v1.20.1, v1.20 to get a specific stable version.
  • unstable to get the latest unstable version.
+ unstable-v1.33.159, unstable-v1.33 to get a specific unstable version.

What is Tailscale?

Tailscale lets you connect your devices and users together in your own secure virtual private network. Tailscale enables encrypted point-to-point connections using the open source WireGuard protocol.
Read more about Tailscale and what you can do with Tailscale in containers.

How to use this image

This image includes all the Tailscale binaries.
To build the Dockerfile:
docker build -t tailscale/tailscale .

To run the tailscaled agent:
docker run -d --name=tailscaled -v /var/lib:/var/lib -v /dev/net/tun:/dev/net/tun --network=host --cap-add=NET_ADMIN --cap-add=NET_RAW tailscale/tailscale

We recommend you use an auth key for an ephemeral node when using Tailscale in a container, which can be accomplished by passing in a TSAUTHKEY environment variable:
docker run -d --name=tailscaled -v /var/lib:/var/lib -v /dev/net/tun:/dev/net/tun --network=host --cap-add=NET_ADMIN --cap-add=NET_RAW --env TS_AUTHKEY=tskey-auth-ab1CDE2CNTRL-0123456789abcdef tailscale/tailscale

To see status:
docker exec tailscaled tailscale --socket /tmp/tailscaled.sock status

Parameters

  • TS_ACCEPT_DNS: Accept DNS configuration from the admin console. Not accepted by default.
  • TS_AUTH_ONCE: Attempt to log in only if not already logged in. False by default, to forcibly log in every time the container starts.
  • TS_AUTHKEY: A Tailscale auth key used to authenticate the container.
  • TS_DEST_IP: Proxy all incoming Tailscale traffic to the specified destination IP.
  • TS_KUBE_SECRET: If running in Kubernetes, the Kubernetes secret name where Tailscale state is stored. The default is tailscale.
  • TS_HOSTNAME: Use the specified hostname for the node.
  • TS_OUTBOUND_HTTP_PROXY_LISTEN: Set an address and port for the HTTP proxy.
  • TS_ROUTES: Advertises subnet routes. Equivalent to tailscale set --advertise-routes=. To accept advertised routes, use TS_EXTRA_ARGS to pass in --accept-routes.
  • TS_SOCKET: Unix socket path used by the Tailscale binary, where the tailscaled LocalAPI socket is created. The default is /var/run/tailscale/tailscaled.sock.
  • TS_SOCKS5_SERVER: Set an address and port for the SOCKS5 proxy.
  • TS_STATE_DIR: Directory where the state of tailscaled is stored. This needs to persist across container restarts.
  • TS_USERSPACE: Enable userspace networking, instead of kernel networking. Enabled by default.

Extra arguments:
  • TS_EXTRA_ARGS: any other CLI flags for tailscale set
  • TS_TAILSCALED_EXTRA_ARGS: any other flags for tailscaled

For reference, see also the Tailscale documentation for this image.

Frequently Asked Questions

Why do I get a new IP address every time the container restarts?

The most common uses for containers are dynamic, where containers come and go depending on load. By default tailscaled stores its state in /tmp and expects to be an ephemeral node.
To support a long-lived service where the container retains its settings and identity across restarts, several things need to be done:
  • The container must be provided with persistent storage, such as -v /var/lib/tailscale:/var/lib/tailscale
  • Set TSSTATEDIR to the location where the persistent storage has been mounted, like -e TS_STATE_DIR=/var/lib/tailscale

Why do incoming connections work but not outgoing?

To support any arbitrary process using Linux sockets, tailscaled needs access to a /dev/net/tun device which many containers do not provide. By default the Dockerfile runs in userspace-networking mode, where incoming connections over the Wireguard tunnel are forwarded to the same port on localhost but initiating new connections would require SOCKS5 or HTTP proxies to be used.
To support outgoing connections from any socket application:
  • The container must be provided with a TUN device, such as -d /dev/net/tun:/dev/net/tun
  • TS_USERSPACE must be set to false, such as -e TS_USERSPACE=0

License

See license information.

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

  • In Portainer, go to Containers, click the container, then Logs. Or run docker logs <container>
  • Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Permission denied on volumes

If the logs show "permission denied", the app can't write to its data folder on the host.

  • Fix the ownership: sudo chown -R 1000:1000 /portainer/Files/AppData/Config/tailscale (and the same for the other mapped folders)

Image won't pull

Test the pull directly on the host: docker pull tailscale/tailscale:latest

  • "manifest unknown" means the tag no longer exists. This template uses latest, so try pinning a specific version instead.
  • "toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
  • "no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

  • This image supports: amd64, arm64, arm/v7, 386
  • Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Container keeps restarting

The unless-stopped restart policy relaunches the app after every crash, so the real error can scroll past.

  • Check the logs right after a restart, the last few lines before it died are the useful ones.
  • Get the exit code with docker inspect <container> --format '{{.State.ExitCode}}'
  • Still stuck? Redeploy once with the restart policy set to no so the failure stays visible.

Stack won't deploy

Compose stacks fail fast on small mistakes, and Portainer shows the reason just above the editor.

  • YAML only accepts spaces for indentation, a single tab breaks the whole file.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

A Compose stack

Tailscale (stack) is a Compose stack, a set of containers defined in one file and brought up together by Portainer, then started and stopped as a single app.

The app image

An image is the app packed up ready to go, everything Tailscale (stack) needs bundled into one download. This template pulls tailscale/tailscale:latest, which Docker fetches once (about 54 MB) and then starts your own copy from.

Where the image comes from

Docker pulls its images from registries, public libraries of ready-built apps. Tailscale (stack)'s comes from Docker Hub, published by tailscale.

Version tags

The bit after the colon in the image name is the version tag. Here it's latest, which always points at the newest build, so a redeploy can bump you to a newer release without you asking. Newest right now is v1.102.2. Pin a specific tag if you would rather stay on one version.

Which machines it runs on

Every image is built for particular CPU types. This one ships for amd64, arm64, arm/v7, 386, so it runs on both regular x86 servers and ARM boards like a Raspberry Pi.

Volumes

A volume is where Tailscale (stack) keeps its files so they survive an update or a restart. Without one, anything it saves would sit inside the container and vanish the moment it's recreated. This template mounts:

  • /var/lib from /portainer/Files/AppData/Config/tailscale on the host
  • /dev/net/tun from /dev/net/tun on the host

Restart policy

The restart policy here is unless-stopped, so Docker restarts Tailscale (stack) after a crash or reboot, but leaves it off when you stop it on purpose. You can change this on the deploy screen. The choices are no (never restart), on-failure (only after a crash), unless-stopped (restart unless you stop it), and always (bring it back no matter what).

Networking

Nothing custom is set, so Tailscale (stack) sits on Docker's default bridge network: its own private space that reaches the outside world only through the ports it publishes.

Container name

Once it's deployed, Portainer names the container tailscale. That's what you'll spot in the containers list and use in commands like docker logs tailscale.

Startup command

The command is what runs the moment the container starts. This template sets its own, tailscaled, in place of the image's default.

Platform

The platform is linux, the kind of system the container is built to run on. Docker and Portainer handle this on a normal Linux server.

Open source license

Tailscale (stack) is open source, released under the BSD-3-Clause license. In plain terms the code is out in the open, so you're free to run it and change it to fit what you need.

Portainer app templates

Zooming out, this whole page comes from a Portainer app template: a short recipe telling Portainer how to set Tailscale (stack) up. Add the template list to Portainer once, then deploying Tailscale (stack) is a click rather than a wall of config.