3 ms·

Tbh I prefer not exposing any ports directly, and then throwing Tailscale on the network used by docker. This automatically protects everything behind a private

Tbh I prefer not exposing any ports directly, and then throwing Tailscale on the network used by docker. This automatically protects everything behind a private network too.

smarx007 2y ago
I would love to read a write-up on that! Are you doing something like https://tailscale.com/blog/docker-tailscale-guide https://tailscale.com/blog/docker-tailscale-guide ?
- aaomidi 2y ago
  Yep! That's very similar to what I do. I have a tailscale container, and a traefik container. Then I use labels with all my other containers to expose themselves on Traefik.
yx827ha 2y ago
I agree, Tailscale FTW! You didn't even need to integrate it with docker. Just add a subnet route and evening just works. It's a great product.
Manouchehri 2y ago
Another option is using Cloudflare Tunnels (`cloudflared`), and stacking Cloudflare Access on top (for non-public services) to enforce authentication.
- aaomidi 2y ago
  just fyi cloudflare closes any idle connection thats been around longer than 10 seconds.
- sieabahlpark 2y ago
  [dead]
diggan 2y ago
FOSS alternative is to throw up a $5 VPS on some trusted host, then use Wireguard (FOSS FTW) to do basically exactly the same, but cheaper, without giving away control and with better privacy. There is bunch of software that makes this easier than trivial too, one example: https://github.com/g1ibby/auto-vpn/ https://github.com/g1ibby/auto-vpn/
- eadmund 2y ago
  Or you can use headscale (BSD) with the Tailscale client (BSD), which is still FOSS but also very very easy to use.
bakugo 2y ago
Important to note that, even if you use Tailscale, the firewall punching happens regardless, so you still have to make sure you either: 1. Have some external firewall outside of the Docker host blocking the port 2. Explicitly tell Docker to bind to the Tailscale IP only
- aaomidi 2y ago
  > the firewall punching happens regardless Does it? I think it only happens if you specifically enumerate the ports. You do not need to enumerate the ports at all if you're using Tailscale as a container.
  - bakugo 2y ago
    Oh, I didn't realize you meant running Tailscale in docker, my bad. Then yeah, that's safe.

Tbh I prefer not exposing any ports directly, and then throwing Tailscale on the network used by docker. This automatically protects everything behind a private network too.

smarx007 2y ago

I would love to read a write-up on that! Are you doing something like https://tailscale.com/blog/docker-tailscale-guide https://tailscale.com/blog/docker-tailscale-guide ?

aaomidi 2y ago
Yep! That's very similar to what I do. I have a tailscale container, and a traefik container. Then I use labels with all my other containers to expose themselves on Traefik.

yx827ha 2y ago

I agree, Tailscale FTW! You didn't even need to integrate it with docker. Just add a subnet route and evening just works. It's a great product.

Manouchehri 2y ago

Another option is using Cloudflare Tunnels (`cloudflared`), and stacking Cloudflare Access on top (for non-public services) to enforce authentication.

aaomidi 2y ago
just fyi cloudflare closes any idle connection thats been around longer than 10 seconds.
sieabahlpark 2y ago
[dead]

diggan 2y ago

FOSS alternative is to throw up a $5 VPS on some trusted host, then use Wireguard (FOSS FTW) to do basically exactly the same, but cheaper, without giving away control and with better privacy. There is bunch of software that makes this easier than trivial too, one example: https://github.com/g1ibby/auto-vpn/ https://github.com/g1ibby/auto-vpn/

eadmund 2y ago
Or you can use headscale (BSD) with the Tailscale client (BSD), which is still FOSS but also very very easy to use.

bakugo 2y ago

Important to note that, even if you use Tailscale, the firewall punching happens regardless, so you still have to make sure you either: 1. Have some external firewall outside of the Docker host blocking the port 2. Explicitly tell Docker to bind to the Tailscale IP only

aaomidi 2y ago
> the firewall punching happens regardless Does it? I think it only happens if you specifically enumerate the ports. You do not need to enumerate the ports at all if you're using Tailscale as a container.
- bakugo 2y ago
  Oh, I didn't realize you meant running Tailscale in docker, my bad. Then yeah, that's safe.