Skip to content

Tailscale Tailscale Tailscale

Description / nameInput element
Container Registry
Container Configuration Root Path
Tailscale /config Path

Build Status Last Commit OCI Pulls

Zero-config mesh VPN built on WireGuard — securely connect your devices without port forwarding or firewall changes.
Registry ghcr.io/daemonless/tailscale
Daemonless daemonless/tailscale
Source tailscale/tailscale
Website tailscale.com

Version Tags

Tag Description Best For
latest / pkg FreeBSD Quarterly. Uses stable, tested packages. Most users — recommended.
pkg-latest FreeBSD Latest. Rolling package updates. Staying current.

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions, including the security model for host vs. container privileges.

Deployment

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
services:
  tailscale:
    image: "ghcr.io/daemonless/tailscale:latest"
    container_name: tailscale
    environment:
      - TS_AUTHKEY=tskey-auth-xxxx  # Tailscale Auth Key for automatic login — create one at https://login.tailscale.com/admin/settings/keys
      - TS_EXTRA_ARGS=--advertise-exit-node  # Additional arguments for tailscale up
    volumes:
      - "/containers/tailscale:/config"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

Save as compose.yaml, then run podman-compose up -d.

1
2
3
4
5
# .env

DIRECTOR_PROJECT=tailscale
TS_AUTHKEY=tskey-auth-xxxx
TS_EXTRA_ARGS=--advertise-exit-node

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  tailscale:
    name: tailscale
    options:
      - container: 'args:--pull'
    oci:
      user: root
      environment:
        - TS_AUTHKEY: !ENV '${TS_AUTHKEY}'
        - TS_EXTRA_ARGS: !ENV '${TS_EXTRA_ARGS}'
    volumes:
      - TAILSCALE_CONFIG_PATH: /config
volumes:
  TAILSCALE_CONFIG_PATH:
    device: '/containers/tailscale'

1
2
3
4
5
6
7
# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/tailscale:${tag}

Save the files above, then run appjail-director up.

Experimental

Bastille's OCI support is experimental. It requires buildah and shares the host network stack (inherit). Mount volumes with --volume HOST JAIL; without it, image-declared volumes are stored under ${bastille_volumesdir}/${jail}.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
services:
  tailscale:
    name: tailscale
    image: "ghcr.io/daemonless/tailscale:latest"
    network:
      - mode: host
    environment:
      - TS_AUTHKEY=tskey-auth-xxxx
      - TS_EXTRA_ARGS=--advertise-exit-node
    volumes:
      - "/containers/tailscale:/config"

Save as bastille-compose.yml, then run bastille up.

Interactive Configuration

Parameters

Environment Variables

Variable Default Description
TS_AUTHKEY tskey-auth-xxxx Tailscale Auth Key for automatic login — create one at https://login.tailscale.com/admin/settings/keys
TS_EXTRA_ARGS --advertise-exit-node Additional arguments for tailscale up

Volumes

Path Description
/config State directory (tailscaled.state)

Implementation Details

  • Architectures: amd64
  • User: root — the service process stays root by design, not dropped to bsd.
  • Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).

Need help? Join our Discord community.