Tailscale

Zero-config mesh VPN built on WireGuard — securely connect your devices without port forwarding or firewall changes.

Registry	ghcr.io/daemonless/tailscale
Source	https://github.com/tailscale/tailscale
Website	https://tailscale.com/

Version Tags

Tag	Description	Best For
latest / pkg	FreeBSD Quarterly. Uses stable, tested packages.	Most users — recommended.
pkg-latest	FreeBSD Latest. Rolling package updates.	Staying current.

Prerequisites

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions.

Deployment

Podman Compose

services:
  tailscale:
    image: "ghcr.io/daemonless/tailscale:latest"
    container_name: tailscale
    environment:
      - TS_AUTHKEY=tskey-auth-xxxx  # Optional: Tailscale Auth Key for automatic login
      - TS_EXTRA_ARGS=--advertise-exit-node  # Optional: Additional arguments for tailscale up
    volumes:
      - "/path/to/containers/tailscale:/config"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

Save as compose.yaml, then run podman-compose up -d.

AppJail Director

.env:

# .env

DIRECTOR_PROJECT=tailscale
TS_AUTHKEY=tskey-auth-xxxx
TS_EXTRA_ARGS=--advertise-exit-node

appjail-director.yml:

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  tailscale:
    name: tailscale
    options:
      - container: 'boot args:--pull'
    oci:
      user: root
      environment:
        - TS_AUTHKEY: !ENV '${TS_AUTHKEY}'
        - TS_EXTRA_ARGS: !ENV '${TS_EXTRA_ARGS}'
    volumes:
      - tailscale: /config
volumes:
  tailscale:
    device: '/path/to/containers/tailscale'

Makejail:

# Makejail

ARG tag=latest

OPTION overwrite=force
OPTION from=ghcr.io/daemonless/tailscale:${tag}

Save the files above, then run appjail-director up.

Podman CLI

podman run -d --name tailscale \
  -e TS_AUTHKEY=tskey-auth-xxxx \
  -e TS_EXTRA_ARGS=--advertise-exit-node \
  -v /path/to/containers/tailscale:/config \
  ghcr.io/daemonless/tailscale:latest

Save as run.sh, then run sh run.sh.

AppJail

appjail oci run -Pd \
  -o overwrite=force \
  -o container="args:--pull" \
  -o virtualnet=":<random> default" \
  -o nat \
  -e TS_AUTHKEY=tskey-auth-xxxx \
  -e TS_EXTRA_ARGS=--advertise-exit-node \
  -o fstab="/path/to/containers/tailscale /config <pseudofs>" \
  ghcr.io/daemonless/tailscale:latest tailscale

Save as run.sh, then run sh run.sh.

Bastille

Warning

Bastille's OCI support is experimental. It requires buildah, shares the host network stack (inherit), and persists image-declared volumes under --data-path.

services:
  tailscale:
    image: "ghcr.io/daemonless/tailscale:latest"
    container_name: tailscale
    network_mode: host  # jail shares host networking
    environment:
      - TS_AUTHKEY=tskey-auth-xxxx
      - TS_EXTRA_ARGS=--advertise-exit-node

Save as podman-compose.yml, then run bastille up. Or via CLI:

bastille create -O \
  --env TS_AUTHKEY=tskey-auth-xxxx \
  --env TS_EXTRA_ARGS=--advertise-exit-node \
  --data-path /path/to/containers/tailscale \
  tailscale ghcr.io/daemonless/tailscale:latest inherit

Ansible

- name: Deploy tailscale
  containers.podman.podman_container:
    name: tailscale
    image: "ghcr.io/daemonless/tailscale:latest"
    state: started
    restart_policy: always
    env:
      TS_AUTHKEY: "tskey-auth-xxxx"
      TS_EXTRA_ARGS: "--advertise-exit-node"
    volumes:
      - "/path/to/containers/tailscale:/config"

Save as tailscale-deploy.yaml, then run ansible-playbook tailscale-deploy.yaml.

Parameters

Environment Variables

Variable	Default	Description
TS_AUTHKEY	tskey-auth-xxxx	Optional: Tailscale Auth Key for automatic login
TS_EXTRA_ARGS	--advertise-exit-node	Optional: Additional arguments for tailscale up

Volumes

Path	Description
/config	State directory (tailscaled.state)

Architectures: amd64 User: root (UID/GID via PUID/PGID, defaults to 1000:1000) Base: FreeBSD 15.1

---

Need help? Join our Discord community.