# Tailscale [](https://github.com/daemonless/tailscale/actions) [](https://github.com/daemonless/tailscale/commits) [](https://hub.docker.com/r/daemonless/tailscale) Zero-config mesh VPN built on WireGuard — securely connect your devices without port forwarding or firewall changes. | | | |---|---| | **Registry** | `ghcr.io/daemonless/tailscale` | | **Source** | [https://github.com/tailscale/tailscale](https://github.com/tailscale/tailscale) | | **Website** | [https://tailscale.com/](https://tailscale.com/) | ## Version Tags | Tag | Description | Best For | | :--- | :--- | :--- | | `latest` / `pkg` | **FreeBSD Quarterly**. Uses stable, tested packages. | Most users — recommended. | | `pkg-latest` | **FreeBSD Latest**. Rolling package updates. | Staying current. | ## Prerequisites Before deploying, ensure your host environment is ready. See the [Quick Start Guide](https://daemonless.io/guides/quick-start) for host setup instructions. ## Deployment ### Podman Compose ```yaml services: tailscale: image: "ghcr.io/daemonless/tailscale:latest" container_name: tailscale environment: - TS_AUTHKEY=tskey-auth-xxxx # Tailscale Auth Key for automatic login — create one at https://login.tailscale.com/admin/settings/keys - TS_EXTRA_ARGS=--advertise-exit-node # Additional arguments for tailscale up volumes: - "/containers/tailscale:/config" # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot restart: always ``` Save as `compose.yaml`, then run `podman-compose up -d`. ### AppJail Director **.env**: ``` # .env DIRECTOR_PROJECT=tailscale TS_AUTHKEY=tskey-auth-xxxx TS_EXTRA_ARGS=--advertise-exit-node ``` **appjail-director.yml**: ```yaml # appjail-director.yml options: - virtualnet: ': default' - nat: services: tailscale: name: tailscale options: - container: 'args:--pull' oci: user: root environment: - TS_AUTHKEY: !ENV '${TS_AUTHKEY}' - TS_EXTRA_ARGS: !ENV '${TS_EXTRA_ARGS}' volumes: - tailscale: /config volumes: tailscale: device: '/containers/tailscale' ``` **Makejail**: ``` # Makejail ARG tag=latest OPTION container=boot OPTION overwrite=force OPTION from=ghcr.io/daemonless/tailscale:${tag} ``` Save the files above, then run `appjail-director up`. ### Bastille > [!WARNING] > Bastille's OCI support is **experimental**. It requires `buildah` and shares the host network stack (`inherit`). Mount volumes with `--volume HOST JAIL`; without it, image-declared volumes are stored under `${bastille_volumesdir}/${jail}`. ```yaml services: tailscale: name: tailscale image: "ghcr.io/daemonless/tailscale:latest" network: - mode: host environment: - TS_AUTHKEY=tskey-auth-xxxx - TS_EXTRA_ARGS=--advertise-exit-node volumes: - "/containers/tailscale:/config" ``` Save as `bastille-compose.yml`, then run `bastille up`. ## Parameters ### Environment Variables | Variable | Default | Description | |----------|---------|-------------| | `TS_AUTHKEY` | `tskey-auth-xxxx` | Tailscale Auth Key for automatic login — create one at https://login.tailscale.com/admin/settings/keys | | `TS_EXTRA_ARGS` | `--advertise-exit-node` | Additional arguments for tailscale up | ### Volumes | Path | Description | |------|-------------| | `/config` | State directory (tailscaled.state) | **Architectures:** amd64 **User:** `root` — the service process stays root by design, not dropped to `bsd` **Base:** FreeBSD 15.1 --- Need help? Join our [Discord](https://discord.gg/Kb9tkhecZT) community.