6 ms·
The Tailscale Universal Docker Mod
- johng 3y agoThis is really cool.
- upon_drumhead 3y agoWhile this is super cool, it's not Universal. It requires usage of containers based upon LinuxServer.io containers.
- wutwutwat 3y agoHow does the base image make them not universal?
- upon_drumhead 3y agoNot every container is based on the LinuxServer.io stack. I can't take any arbitrary container and use the docker mod and have it work. I have over 25 containers running on my home server and not a single one of them is based on a LinuxServer.io image. This "universal" mod would work with 0 of them.
- bigmattystyles 3y agoWould you list them? I’m always looking for cool new containers for my homelab
- upon_drumhead 3y agoWireguard + GUI: https://github.com/wg-easy/wg-easy https://github.com/wg-easy/wg-easy Managing all those household docs: https://docs.paperless-ngx.com https://docs.paperless-ngx.com Backups of mail accounts: https://www.offlineimap.org https://www.offlineimap.org Cloud storage for phones: http://nextcloud.com http://nextcloud.com Mirroring podcasts locally: https://github.com/akhilrex/podgrab https://github.com/akhilrex/podgrab Managing dynamic service dns via plugins: https://coredns.io https://coredns.io My own matrix instance: https://matrix-org.github.io/dendrite/ https://matrix-org.github.io/dendrite/ Backups: https://restic.net https://restic.net Media Management: https://jellyfin.org https://jellyfin.org Relay only tor help: https://www.torproject.org https://www.torproject.org S3 compatible storage: https://github.com/seaweedfs/seaweedfs https://github.com/seaweedfs/seaweedfs Git + CI: https://about.gitlab.com https://about.gitlab.com Managing SSL and container proxying: https://traefik.io https://traefik.io Mirror the docker registry locally: https://github.com/docker-library/docs/tree/master/registry https://github.com/docker-library/docs/tree/master/registry Samba support for the windows hosts: https://github.com/ServerContainers/samba https://github.com/ServerContainers/samba HTTP/S Proxy with support for modifying results: http://www.privoxy.org http://www.privoxy.org Database: https://www.postgresql.org https://www.postgresql.org Datastore: https://redis.io https://redis.io and a bunch of support software. Paperless has Tika and Gotenberg as deps for example.
- bigmattystyles 3y agoAwesome! Thank you!
- mroche 3y agoDo you find GitLab and its Runners to be heavy at all in your home lab? I'm curious if anyone's been using Gitea/Forgejo with Actions or Woodpecker (Drone).
- upon_drumhead 3y agoI have the runner set to poll every 60 seconds, so it's not using any real resources unless it's running a build. Gitlab itself is the heaviest consumer of resources, however, having the integrated CI system is worth it for me. I use gitlab at work, so it's familiar.
- justsomehnguy 3y ago> Cloud storage for phones: http://nextcloud.com http://nextcloud.com Thanks, that sums it up for me. I used OC/NC for years but in the last three I mostly abandoned it because the desktop app (for Windows, at least) is atrocious and Android one... isn't good either. But as on-demand document download with occasional upload it's fine.
- ehPReth 3y agodo you find any blocklisting issues running a relay only? i heard in the long, long ago that people who even just ran relays would find themselves on IP blocklists because of ignorant blocklist builders not knowing the difference between exit and non-exit nodes or grabbing the wrong lists
- upon_drumhead 3y agoI have not and I’ve run the relay for about 5 years now. I do get lots of captchas on cloudflare, but generally they’re just the click to prove you are a human style and it’s not too bad for the household.
- wutwutwat 3y agoAs others have said, you can run a sidecar container and proxy your current containers through the sidecar, and into the Tailscale network. They are universal in that the docker containers can run on any docker host, not that they are guaranteed to mesh/drop in and run inside whatever random containers you already run. Not sure why I am being downvoted for asking a genuine question out of curiosity…
- RockRobotRock 3y agoLinuxServer.io containers rock for homelab. Not sure why you wouldn't use them.
- xena 3y agoIt's called a "universal" mod because it can work on any linuxserver.io container image.
- vineyardmike 3y agoThis is really cool, I didn’t even know Docker mods existed. That’s the best kind of cool. I wonder if the internals will be open sourced? I assume it’s a pretty “simple” go tcp proxy that listens on the tailnet instead of an open port. I had been thinking about writing one for our services at work, so maybe we can use this, but I’d prefer to build the binary directly into our containers.
- figmert 3y agoDocker doesn't do mods. As the article says, this is possible due to s6 and s6-overlay, which is included with linuxserver.io docker images, combined with a set up scripts that set it all up. This does prevent your containers from being immutable. All the code for LSIO images is available on their GitHub.
- _cenw 3y agoIt's likely just `tailscale serve https / <upstream>`. https://github.com/tailscale/tailscale/blob/main/ipn/serve.go https://github.com/tailscale/tailscale/blob/main/ipn/serve.g... And they also support direct embedding: https://tailscale.dev/blog/embedded-funnel https://tailscale.dev/blog/embedded-funnel I think this is built on the wireguard-go + gvisor mashup, that allows you to do this with just Wireguard: https://github.com/WireGuard/wireguard-go/tree/master/tun/netstack https://github.com/WireGuard/wireguard-go/tree/master/tun/ne... One of my favorite applications of this is this little tool that turns Wireguard VPNs into SOCKS5 proxies (which you can selectively enable in your browser) https://github.com/octeep/wireproxy https://github.com/octeep/wireproxy
- debarshri 3y agoThis is really cool. Networking in general is full of quirks and what people think is full of "magic". Full disclosure, I am founder of Adaptive [1]. We use a similar technique to the one with VPN exposed as SOCK5 proxy but for accessing internal infrastructure resources. [1] https://adaptive.live/ https://adaptive.live/
- 3y ago
- _cenw 3y agoI would disagree that containers aren't supposed to run more than one process. It's just discouraged because a lot of people aren't well versed in the pitfalls of being PID 1. Fedora's toolbox is a great counter-example, as is systemd now being able to boot up as your PID 1 in some container distros without much modification.
- Sayrus 3y agoTo be fair, even for running a single process the pitfalls are real. I've been seeing Tini[1] a lot for these situations. I just read in the README that Tini is included by Docker since 1.13 if using --init flag. [1] https://github.com/krallin/tini https://github.com/krallin/tini
- crypt1d 3y agoI am really impressed by what the tailscale folks have been building. I use their product suite regularly and have nothing but good things to say about it. I will be tinkering with this mod as well starting next week ;) keep it up guys!
- eclipsetheworld 3y agoI just love that this blog post includes an AI-generated image with the caption of course being the name of the model and the given prompt.
- xena 3y agoI always hate when the images don't have the prompt shown. I'm glad you appreciate me adding it there!
- FloatArtifact 3y agoAll we need now is something for kubernetes
- conradludgate 3y agohttps://tailscale.com/kb/1236/kubernetes-operator https://tailscale.com/kb/1236/kubernetes-operator It's actually even easier to use. Add `tailscale.com/expose: "true"` to a kubernetes service annotations and it will be added to the tailnet automatically
- isoprophlex 3y agoWow, looks super comfy. Tailscale really seems to be doing everything right lately.
- xena 3y agoWhat I think is the really cool part about this is that tailscaled is able to store its state in a Kubernetes secret on the fly so that it can dynamically update itself and handle being restarted on a new runner node. This isn't the same as true multiple nodes with the same IP, but when combined with automatic restarts it gets way closer to that in practice than it has any right to.
- MrPowerGamerBR 3y agoFor those who want to run Tailscale on their Docker containers, but don't want to switch to images based off linuxserver.io, you can still run Tailscale as a sidecar container, and use "network_mode: service:tailscale" I do that for my containers and it is incredibly useful for cross containers communication, especially for containers that are hosted in different dedicated servers. https://mrpowergamerbr.com/us/blog/2023-03-20-untangling-your-network-tailscale-in-docker-compose/ https://mrpowergamerbr.com/us/blog/2023-03-20-untangling-you...
- rcarmo 3y agoThis seems a lot cleaner than injecting new binaries into existing images or depending on linuxserver.io images.
- tylergetsay 3y agoThe "benefit" of one tailscale daemon per container is https/external access/etc can be handled automatically
- iansinnott 3y agoDoes linuxserver.io have a bad reputation? or is it just that it's yet another dependency in the stack? Asking because I've been happy with their containers so far
- xena 3y agoMany useful images are based on linuxserver.io containers, but most docker images are not based on linuxserver.io.
- wccrawford 3y agoI use quite a few linuxserver.io containers on my home stack on my Synology NAS, and they've been awesome. When I see that they're from there, I know they'll be reliable and the setup process is going to be straightforward and similar to other containers I've already used. Ironically, the 1 container I really wanted to use this Tailscale mod for was not from linuxserver.
- tornato7 3y agoI wonder if this will fix the issue of appending -n to new ephemeral servers that join the network. For example, if you have a service wiki-1 and that container/instance gets restarted, it then appears on your tailnet as wiki-1 making users unable to access it at wiki/ Their official solution is to run a logout command before shutting down but that's not always possible.
- xena 3y agoThis is where mounting a state volume helps. If you mount a state volume, you don't need to make the containers ephemeral unless you expect them to move between hosts frequently. If that is the case, I'd love to hear more about your use case so that I can suggest a better alternative.
- tornato7 3y agoThat is helpful to know for Docker containers, thank you. The use-case where we find the renaming most frustrating is typically when we start a cloud instance with a Tailscale setup script in the cloud init (via Terraform). If we, say, change a parameter that requires Terraform to restart that instance, then the freshly-started instance will be given a `-1` name by Tailscale and the old instance will be offline. I wish there would simply be a --force-hostname option or something of that nature that tells Tailscale "if a host is authenticating with this name, give it that name, any older machines using that name should be kicked off"
- skippyboxedhero 3y agoI have never been sure what the security implications are but I just set ports to the tailscale address, and everything is accessible. So if the local tailscale address is 1.2.3.4, I do: ports: - 1.2.3.4:8080:8080 This doesn't actually add applications to the tailnet as in the OP, but it works.
- xena 3y agoYeah, the main advantage of giving your containers their own IP addresses is the ability to use Tailscale as a service discovery mesh. If you combine this with MagicDNS, this gets you most of an 80:20 of Istio with about 10% of the configuration required!
- gonzo 3y agoArticle is six months old
- wccrawford 3y agoIt looks like I need to regenerate the auth key every 90 days, which kind of kills this for me. I definitely don't want to have to update all my docker stuff every 90 days, and it's almost assuredly going to go offline right when I can't deal with it.
- zrail 3y agoThe trick is to persist the tailscale var volume. The auth key is only used when setting up a particular client the first time, once it's connected to your network the auth key is irrelevant. If you're doing this with ephemeral containers then yes you'll need a way to roll auth keys. OAuth credentials don't expire and Tailscale has a command line single purpose tool to get an auth key given OAuth credentials, so that can be a viable alternative. https://tailscale.com/kb/1215/oauth-clients/#get-authkey-utility https://tailscale.com/kb/1215/oauth-clients/#get-authkey-uti...
- wccrawford 3y agoOh, that makes a huge difference, then. I had wondered why anything needed to be persistent. Thanks!
- elesbao 3y agoThis post is great as the current state of network mesh is too complex for some users. That led me to write a simple rust daemon to run a TLS proxy and spawn the original app locally, reverse proxying requests as the cost of implementing a full mesh just to have tls across applications was too much for my team at the time. I didn't knew about ONRUN, s6 and all that. Also, why not tailscale as the mesh ?
- ptman 3y agoThere is no ONRUN: "you can think of docker mods as a missing ONRUN hook"
- xena 3y agoAuthor of the post here in case you have any questions!
- binwiederhier 3y agoNo question, just a thanks. I've read a lot of your stuff, and it's always incredibly insightful and clever. Thanks for being an amazing Internet citizen!
- RockRobotRock 3y agoyou rock
- chris_st 3y agoJust another boring "thanks for your fantastic blog posts!" post. Love the personalities in them too :-)
- gerty 3y agoIs there any reason it wouldn't work with podman?
- xena 3y agoI don't think so. Though I am looking into a CNI plugin to make things more seamless.