Connect to Your HomeLab Remotely with Tailscale in Docker

Tailscale creates a private WireGuard-based network for reaching HomeLab services without exposing every service port to the Internet. This article adapts the Docker-based setup and enables subnet routing into a LAN.

Source reference: i12bretro – Tailscale in Docker . The original video belongs to i12bretro on YouTube .

Prepare the Tailscale account

1. Open login.tailscale.com and sign in with an available SSO method.
2. Open DNS > Add nameserver > Custom....
3. Enter the DNS server used by the LAN and click Save.
4. Open Settings > Keys under Personal Settings.
5. Click Generate auth key..., enable Reusable, and generate the key.
6. Keep the auth key secure for the container step. Never place the real key in Markdown, logs, or Git.

Install Docker on the Linux host

On the Linux machine that will run the gateway, install Docker and enable its service:

1
2
3
4
5
6
7

sudo apt install apt-transport-https ca-certificates curl software-properties-common gnupg-agent -y
curl -fsSL https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release)/gpg | sudo apt-key add -
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/$(awk -F'=' '/^ID=/{ print $NF }' /etc/os-release) $(lsb_release -cs) stable"
sudo apt install docker-ce docker-compose containerd.io -y
sudo systemctl enable docker && sudo systemctl start docker
sudo usermod -aG docker $USER
su - $USER

Run the Tailscale container as a subnet router

Replace <AUTH_KEY> with the key generated earlier and change TS_ROUTES to the real LAN subnet:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

docker run -d --name=tailscale \
  -v /var/lib:/var/lib \
  -v /dev/net/tun:/dev/net/tun \
  -e TS_ACCEPT_DNS=true \
  --network=host \
  --cap-add=NET_ADMIN \
  --cap-add=NET_RAW \
  --restart=unless-stopped \
  --hostname="ctr-gateway" \
  -e TS_AUTHKEY=<AUTH_KEY> \
  -e TS_ROUTES=192.168.0.0/24 \
  tailscale/tailscale

1. Return to Tailscale and open Machines.
2. Confirm that ctr-gateway is online.
3. Open the device Settings and select Disable key expiry if the gateway should remain available long term.
4. Open Edit route settings....
5. Click Approve all to enable routing into the LAN.

Connect other devices

1. Install the Tailscale client on the computer or phone that needs HomeLab access.
2. Sign in using the same method used to create the account.
3. After the device joins the tailnet, test an internal service through its LAN IP.
4. Advertise only the subnets that are required; avoid routing more of the network than necessary.

Security note: An auth key grants access to the tailnet. Do not commit it to Docker Compose, a shared shell history, or a repository. Revoke and replace it if exposure is suspected.

Source and video

• Original tutorial: i12bretro 0110
• Original video: Tailscale in Docker
• Tailscale: What is Tailscale?
• Docker image: tailscale/tailscale