A deep dive into using Tailscale with Docker

Summary

The video script discusses the integration of Tailscale with Docker for creating secure, interconnected containerized environments. It explains the benefits of running Tailscale in a container, such as ACL control, reverse proxy replacement, and the ability to connect services across different locations. The script covers how to add a container to a Tailnet using both an auth key and an OAuth client, highlighting the differences in API access, lifespan, and tagging between the two methods. It also delves into Docker's networking with Linux kernel namespaces and how Tailscale's 'serve' and 'funnel' can be used to expose applications on the public internet securely. The video concludes with a practical example of setting up a self-hosted recipe manager on the Tailnet with HTTPS support, demonstrating the ease of managing complex container networking through Tailscale.

Takeaways

• 📦 **Containers in Production**: Using containers in production has become the norm, unlike 10 years ago when it was unusual.
• 🌟 **Tailscale and Docker**: The video discusses the integration of Tailscale with Docker, including adding containers to a Tailnet and exposing applications to the public internet.
• 🔒 **Security and Control**: Tailscale allows for control access via ACLs and can replace reverse proxies, enhancing security without complex configurations.
• 🛠️ **Technical Possibilities**: Tailscale enables connecting services across different environments, such as a home GPU workload with cloud services like AWS or GCP.
• 🚧 **Simplicity of Networking**: Tailscale's encrypted WireGuard-based tunnels eliminate the need for port forwarding, complex firewall rules, or dynamic DNS.
• 🐳 **Official Docker Image**: Tailscale provides an official Docker image available on Docker Hub and GitHub, with customizable parameters through environment variables.
• 🔑 **Authentication Methods**: Two programmatic methods for adding containers to a Tailnet are discussed: using an auth key and an OAuth client, each with its own advantages and use cases.
• ⏱️ **Key Expiry**: Auth keys have a maximum lifespan of 90 days, but this does not mean that the authenticated nodes expire; they are separate from the node keys used by WireGuard.
• 🏷️ **Tagging and Ownership**: When adding a node to a Tailnet, it must have an owner. Auth keys default to the user who generated the key, while OAuth clients use a tag for ownership.
• 🤝 **Docker Networking**: Docker's network mode allows merging of network namespaces, effectively allowing containers to share the same networking context.
• 🌐 **Exposing Applications**: Tailscale serve and funnel can be used to expose applications running in containers to the Tailnet or the public internet with TLS support from Let's Encrypt.

Q & A

What was considered unusual about running a container in production about 10 years ago?

About 10 years ago, running a container in production was considered unusual because it was not a common practice at the time. Nowadays, not running a container in production is more unusual as it has become a standard approach in the industry.

What are the benefits of adding a container to your Tailnet?

Adding a container to your Tailnet allows you to control access via ACLs, replace reverse proxies, and access any other service on your Tailnet from these containers. It enables seamless connections between services, even those located in different environments like your home and the cloud.

How does Tailscale simplify the process of connecting services?

Tailscale simplifies the process by using encrypted WireGuard-based tunnels, eliminating the need for complex port forwarding, firewall rules, or dynamic DNS configurations.

What are the two primary methods for adding a container to your Tailnet?

The two primary methods for adding a container to your Tailnet are using an auth key and using an OAuth client.

What is the main difference between an auth key and an OAuth client in terms of API access?

An auth key grants full API level access to any client that authenticates using it, whereas an OAuth client limits API access via scoping, allowing for more granular control over what actions can be performed.

What is the maximum lifespan of an auth key in Tailscale?

An auth key in Tailscale has a maximum lifespan of 90 days.

How does the use of tags differ between an auth key and an OAuth client when adding a node to a Tailnet?

With an auth key, the node is added to the Tailnet as the user who generated the key. With an OAuth client, the node is owned by the tag assigned at secret creation time, and the client assumes the identity of a tag owner.

How does Docker's network mode work when adding a container to a Tailnet?

Docker's network mode allows you to group two containers together under the same Linux kernel networking namespace, effectively merging their network contexts.

What is the purpose of Tailscale Serve?

Tailscale Serve acts like a reverse proxy, allowing you to provide a configuration file that directs web requests to specific ports on your Tailnet. It can also automatically request and use TLS certificates from Let's Encrypt for secure connections.

What is the difference between a self-hosted application using Tailscale Serve and Tailscale Funnel?

Tailscale Serve allows you to proxy requests internally to your Tailnet, while Tailscale Funnel can expose the application across the internet, allowing external access with no additional configuration required beyond enabling the feature.

How does mounting a directory instead of a specific file in Docker influence the container's operation?

Mounting a directory instead of a specific file allows Docker to properly detect changes to the files within that directory using fsnotify, which is important for dynamic configurations like those used by Tailscale Serve.

What is the significance of using environment variables like 'ts serve config' in a Docker Compose file?

Environment variables like 'ts serve config' are used to pass configuration information to the Tailscale container, allowing for dynamic and flexible configuration without hardcoding values into the Compose file.