docktail

Docktail does it with labels. Add a label to your Docker container, and Docktail automatically registers it as a Tailscale service. No port forwarding, no VPN configs, no firewall rules.

This solves a specific pain point: you have a dozen self-hosted services in Docker and you want them accessible from your phone, laptop, or remote machines over Tailscale, without opening ports to the internet. Docktail watches your Docker daemon and handles the Tailscale registration automatically. AGPL-3.0, fully free. You need a Tailscale account (free for personal use, up to 100 devices).

The catch: AGPL-3.0 is aggressive copyleft. If you modify this and serve it, you owe the source code. The project is very early. Small community, limited documentation, and if the maintainer moves on, you're forking it yourself. Also, Tailscale itself has limits on the free tier (3 users).