tailscale-deploy

Deploy a Docker application privately with Tailscale by configuring a docker-compose.yml that runs your app alongside a Tailscale sidecar container. The sidecar connects to your Tailnet, making the app accessible via Tailnet hostname without exposing public ports. You'll need a Tailscale account, a reusable auth key in your .env file, and Docker Compose installed.

Yes. Docker Compose orchestrates your application container and Tailscale sidecar together, binding them to a private network. The Tailscale sidecar handles all network connectivity to your Tailnet, eliminating the need for public ports while maintaining accessibility from any device on the Tailnet.

You need Docker and Docker Compose installed, a multi-stage Dockerfile for your F# or containerized application, a docker-compose.yml defining both your app and Tailscale sidecar services, and a .env file containing your Tailscale reusable auth key. The setup works for local testing, production, Portainer stacks, and home servers.

Once deployed with Tailscale, access your application by its Tailnet hostname from any device connected to the same Tailnet. No VPN configuration or public IP needed—Tailscale handles secure routing automatically across all connected devices.

Yes. Tailscale sidecar deployments are compatible with Portainer stacks. You deploy the docker-compose.yml as a stack in Portainer, and the Tailscale sidecar establishes private network connectivity the same way it would in a standalone Docker Compose environment.

Tailscale requires a valid account and reusable auth key; if the key expires or is revoked, the sidecar loses network connectivity. Additionally, all devices accessing the application must be on the same Tailnet, and network throughput depends on Tailscale's infrastructure and your internet connection.