docktail

Docktail is the glue between Docker and Tailscale that should have existed years ago. Add labels to your containers, and Docktail automatically exposes them as Tailscale services — accessible via clean URLs like myapp.tailnet-name.ts.net. No port publishing, no NGINX configs, no manual Tailscale setup per container. It just watches Docker labels and does the right thing.

If you're self-hosting services in Docker and already using Tailscale, Docktail eliminates the tedious per-container networking setup. Tailscale's official Docker integration exists but requires per-container sidecar configuration. Cloudflare Tunnels (via cloudflared) does similar exposure to the public internet. Traefik handles reverse proxy and service discovery but is more complex.

The catch: Docktail is AGPL-3.0 and tiny — 609 stars, single-maintainer project. Your entire service access depends on this tool plus Tailscale staying healthy. It supports Tailscale Funnel for public exposure, but that means trusting a young project with internet-facing traffic. For production workloads, the official Tailscale Docker integration is more battle-tested, even if it's more verbose.