So Tailscale has this whole series about hosting services on one’s Tailnet using Docker. Their approach is to run Tailscale in Docker and have the services’ containers share its namespace by setting network_mode: service:<tailscale_service_name>.
I am trying to understand why this is better than just binding the service’s port to the Tailscale IP of the host device, given that option is not even mentioned in any of their blog posts.
The only advantage I can think of is that you get to have different Tailscale rules/configurations for different services. In my case, this is not an advantage because I will run Tailscale on the host anyway and I won’t have different configurations for each service.
Can anyone help me understand?
Maybe you get the possibility of routing all traffic from a container (or all the containers in that namespace/network) over the tailnet this way? With the host method, you’d need the host to use the exit node too.
From my experience with tailscale so far - there are so many different ways to have it configured well. If it works well for you having it on the host, then go for it. I have home assistant in a VM with tailscale and tailscale on the (windows) host. This works well for my needs and I don’t mind having it running “twice”
I’m just curious if I’m missing something and to learn the best practice as well as the reason why it’s the best practice.
Does the tailscale IP of the host change?
I was hable to include the taislcale image inside every composer of the web apps I’m using in Docket and have their own magic dns and ip. Even turn on funnel from inside the container and get endcription to the internet direct access. There is a guide https://tailscale.com/kb/1282/docker/