So Tailscale has this whole series about hosting services on one’s Tailnet using Docker. Their approach is to run Tailscale in Docker and have the services’ containers share its namespace by setting network_mode: service:<tailscale_service_name>.

I am trying to understand why this is better than just binding the service’s port to the Tailscale IP of the host device, given that option is not even mentioned in any of their blog posts.

The only advantage I can think of is that you get to have different Tailscale rules/configurations for different services. In my case, this is not an advantage because I will run Tailscale on the host anyway and I won’t have different configurations for each service.

Can anyone help me understand?

https://tailscale.com/kb/1282/docker

  • farcaller@fstab.shEnglish
    5·
    2 months ago

    If tailscale inside a container allows you to talk to it via “direct” connection and not a derp proxy, then it will offer you better service isolation (can set the tailscale ACLs for this specific service) without sacrificing performance.

    Tailscale pushes for it because it just ties you in more. It allows to to utilize the ACLs better, to see your thing in their service mesh, and every service will count against the free node limit.

    In practice, I often do both. E.g. I’ll have my http ingress exposed to tailscale and route a bunch of different services through it at a single tailscale node, where the access control is done by services individually. But I’ll also run a pod-to-pod tailscale between two k8s clusters because tailscale ACL is just convenient.

  • superweeniehutjrs@lemmy.worldEnglish
    2·
    2 months ago

    From my experience with tailscale so far - there are so many different ways to have it configured well. If it works well for you having it on the host, then go for it. I have home assistant in a VM with tailscale and tailscale on the (windows) host. This works well for my needs and I don’t mind having it running “twice”

    • Quail4789@lemmy.mlOPEnglish
      2·
      2 months ago

      I’m just curious if I’m missing something and to learn the best practice as well as the reason why it’s the best practice.

  • Prison Mike@links.hackliberty.orgEnglish
    1·
    2 months ago

    I only have experience trying to run two Tailscale containers on the same machine and hit so many roadblocks that running it containerized just wasn’t worth it.

    Containerizing is probably only worth it if you have an explicit need for it.

  • oranki@piefed.socialEnglish
    1·
    2 months ago

    Maybe you get the possibility of routing all traffic from a container (or all the containers in that namespace/network) over the tailnet this way? With the host method, you’d need the host to use the exit node too.

  • geography082@lemm.eeEnglish
    15·
    2 months ago

    I was hable to include the taislcale image inside every composer of the web apps I’m using in Docket and have their own magic dns and ip. Even turn on funnel from inside the container and get endcription to the internet direct access. There is a guide https://tailscale.com/kb/1282/docker/