Tailscale Exit Node Docker Container

Run a Tailscale Exit Node inside a Docker container using userspace networking. This is designed for environments where /dev/net/tun is unavailable, such as Railway, Render, Fly.io, and other container-based platforms.

Features

• Runs Tailscale in Docker
• Uses userspace networking (--tun=userspace-networking)
• Advertises itself as a Tailscale Exit Node
• Supports custom hostname configuration
• Supports additional Tailscale arguments
• Graceful shutdown handling

---

Requirements

• Docker
• A Tailscale account
• Reusable Tailscale Auth Key

Generate an auth key from:

https://login.tailscale.com/admin/settings/keys

---

Environment Variables

Variable	Required	Description
TS_AUTHKEY	Yes	Tailscale authentication key
TS_HOSTNAME	No	Hostname shown in Tailscale (default: railway-exit-node)
TS_EXTRA_ARGS	No	Additional arguments passed to tailscale up

Example

TS_AUTHKEY=tskey-auth-xxxxxxxxxxxxxxxx
TS_HOSTNAME=my-exit-node

---

Build Image

docker build -t tailscale-exit-node .

---

Run Container

docker run -d \
  --name tailscale-exit-node \
  -e TS_AUTHKEY="tskey-auth-xxxxxxxxxxxxxxxx" \
  -e TS_HOSTNAME="my-exit-node" \
  tailscale-exit-node

---

Docker Compose

version: "3.8"

services:
  tailscale:
    build: .
    container_name: tailscale-exit-node
    environment:
      TS_AUTHKEY: tskey-auth-xxxxxxxxxxxxxxxx
      TS_HOSTNAME: my-exit-node
    restart: unless-stopped

Start:

docker compose up -d

---

Approve Exit Node

After the container starts, approve the Exit Node in the Tailscale Admin Console:

https://login.tailscale.com/admin/machines

1. Open Machines
2. Locate the new node
3. Enable Use as Exit Node
4. Save changes

---

Using the Exit Node

On any connected Tailscale device:

Linux

tailscale up --exit-node=<node-ip>

Windows

tailscale set --exit-node=<node-ip>

macOS

tailscale set --exit-node=<node-ip>

Or select the Exit Node from the Tailscale application UI.

---

Logs

View container logs:

docker logs -f tailscale-exit-node

View Tailscale status:

docker exec tailscale-exit-node tailscale status

---

How It Works

The container:

1. Starts tailscaled
2. Uses userspace networking mode
3. Authenticates with Tailscale using TS_AUTHKEY
4. Advertises itself as an Exit Node
5. Waits indefinitely while maintaining the Tailscale connection

---

Security Notes

• Store your auth key securely.
• Use reusable auth keys only when necessary.
• Rotate auth keys periodically.
• Restrict access to approved Tailscale users and devices.

---

License

MIT License