3 ms·

This is really cool, I didn’t even know Docker mods existed. That’s the best kind of cool. I wonder if the internals will be open sourced? I assume it’s a pret

This is really cool, I didn’t even know Docker mods existed. That’s the best kind of cool. I wonder if the internals will be open sourced? I assume it’s a pretty “simple” go tcp proxy that listens on the tailnet instead of an open port. I had been thinking about writing one for our services at work, so maybe we can use this, but I’d prefer to build the binary directly into our containers.

figmert 3y ago
Docker doesn't do mods. As the article says, this is possible due to s6 and s6-overlay, which is included with linuxserver.io docker images, combined with a set up scripts that set it all up. This does prevent your containers from being immutable. All the code for LSIO images is available on their GitHub.
_cenw 3y ago
It's likely just `tailscale serve https / <upstream>`. https://github.com/tailscale/tailscale/blob/main/ipn/serve.go https://github.com/tailscale/tailscale/blob/main/ipn/serve.g... And they also support direct embedding: https://tailscale.dev/blog/embedded-funnel https://tailscale.dev/blog/embedded-funnel I think this is built on the wireguard-go + gvisor mashup, that allows you to do this with just Wireguard: https://github.com/WireGuard/wireguard-go/tree/master/tun/netstack https://github.com/WireGuard/wireguard-go/tree/master/tun/ne... One of my favorite applications of this is this little tool that turns Wireguard VPNs into SOCKS5 proxies (which you can selectively enable in your browser) https://github.com/octeep/wireproxy https://github.com/octeep/wireproxy
- debarshri 3y ago
  This is really cool. Networking in general is full of quirks and what people think is full of "magic". Full disclosure, I am founder of Adaptive [1]. We use a similar technique to the one with VPN exposed as SOCK5 proxy but for accessing internal infrastructure resources. [1] https://adaptive.live/ https://adaptive.live/
  - _cenw 3y ago
    I think we had the same idea, but I didn't get to finish building mine. OIDC tokens being available in most CI systems these days is a nice building block. https://github.com/acuteaura/tinybastion/ https://github.com/acuteaura/tinybastion/
    - debarshri 3y ago
      More than happy to chat, if you drop a email at debarshi [dot] adaptive [dot] live.
xena 3y ago
You're in luck: it's literally normal tailscale https://github.com/tailscale-dev/docker-mod https://github.com/tailscale-dev/docker-mod

figmert 3y ago

Docker doesn't do mods. As the article says, this is possible due to s6 and s6-overlay, which is included with linuxserver.io docker images, combined with a set up scripts that set it all up. This does prevent your containers from being immutable. All the code for LSIO images is available on their GitHub.

_cenw 3y ago

It's likely just `tailscale serve https / <upstream>`. https://github.com/tailscale/tailscale/blob/main/ipn/serve.go https://github.com/tailscale/tailscale/blob/main/ipn/serve.g... And they also support direct embedding: https://tailscale.dev/blog/embedded-funnel https://tailscale.dev/blog/embedded-funnel I think this is built on the wireguard-go + gvisor mashup, that allows you to do this with just Wireguard: https://github.com/WireGuard/wireguard-go/tree/master/tun/netstack https://github.com/WireGuard/wireguard-go/tree/master/tun/ne... One of my favorite applications of this is this little tool that turns Wireguard VPNs into SOCKS5 proxies (which you can selectively enable in your browser) https://github.com/octeep/wireproxy https://github.com/octeep/wireproxy

debarshri 3y ago
This is really cool. Networking in general is full of quirks and what people think is full of "magic". Full disclosure, I am founder of Adaptive [1]. We use a similar technique to the one with VPN exposed as SOCK5 proxy but for accessing internal infrastructure resources. [1] https://adaptive.live/ https://adaptive.live/
- _cenw 3y ago
  I think we had the same idea, but I didn't get to finish building mine. OIDC tokens being available in most CI systems these days is a nice building block. https://github.com/acuteaura/tinybastion/ https://github.com/acuteaura/tinybastion/
  - debarshri 3y ago
    More than happy to chat, if you drop a email at debarshi [dot] adaptive [dot] live.

xena 3y ago

You're in luck: it's literally normal tailscale https://github.com/tailscale-dev/docker-mod https://github.com/tailscale-dev/docker-mod