cloud-init tailscale setup fails due to missing /dev/net/tun

Question

I want to provision a VM in proxmox with cloud-init, such that tailscale will be set up and running on first boot. The image I use is alpine 3.22.1 (nocloud_alpine-3.22.1-x86_64-uefi-cloudinit-r0.qcow2) with kernel 6.12.38-0-virt. Setting up tailscale fails, as there is no tun device present. From /var/log/tailscaled.log

logpolicy: using system state directory "/var/lib/tailscale"
dns: [rc=unknown ret=direct]
dns: using "direct" mode
dns: using *dns.directManager
dns: inotify: NewDirWatcher: context canceled
linuxfw: clear iptables: could not get iptables version: exit status 1
linuxfw: clear ip6tables: could not get iptables version: exit status 1
cleanup: list tables: socket: protocol not supported
wgengine.NewUserspaceEngine(tun "tailscale0") ...
Linux kernel version: 6.12.38-0-virt
is CONFIG_TUN enabled in your kernel? `modprobe tun` failed with: modprobe: FATAL: Module tun not found in directory /lib/modules/6.12.38-0-virt
wgengine.NewUserspaceEngine(tun "tailscale0") error: tstun.New("tailscale0"): CreateTUN("tailscale0") failed; /dev/net/tun does not exist
flushing log.
logger closing down
getLocalBackend error: createEngine: tstun.New("tailscale0"): CreateTUN("tailscale0") failed; /dev/net/tun does not exist
You have disabled logging. Tailscale will not be able to provide support.
logtail started
Program starting: v1.84.2-AlpineLinux, Go 1.24.7: []string{"/usr/sbin/tailscaled", "--socket=/run/tailscale/tailscaled.sock", "--state=/var/lib/tailscale/tailscaled.state", "--port=41641", "--verbose=0", "--no-logs-no-support"}

With the related cloud-init user-data.yaml

#cloud-config

package_update: true
package_upgrade: true
package_reboot_if_required: true

runcmd:
  - modprobe tun
  - sh -c 'curl -fsSL https://tailscale.com/install.sh' | sh
  - service tailscale status
  - tailscale up --auth-key=${headscale_preauth_key}

And the initial output at boot

FATAL: Module tun not found in directory /lib/modules/6.12.38-0-virt
Installing Tailscale for alpine 3.22.1, using method apk
+ grep -Eq '^http.*/community$' /etc/apk/repositories
+ apk add tailscale
(1/3) Installing tailscale (1.84.2-r2)
Executing tailscale-1.84.2-r2.pre-install
Executing tailscale-1.84.2-r2.post-install
*
* tailscaled runs as root by default. [...]
*
(2/3) Installing tailscale-openrc (1.84.2-r2)
(3/3) Installing tailscale-bash-completion (1.84.2-r2)
Executing busybox-1.37.0-r19.trigger
OK: 247 MiB in 225 packages
+ rc-update add tailscale
 * service tailscale added to runlevel default
+ rc-service tailscale start
 * Caching service dependencies ... [ ok ]
 * /var/log/tailscaled.log: creating file
 * /var/log/tailscaled.log: correcting owner
 * /run/tailscale: creating directory
 * /run/tailscale: correcting owner
 * Starting tailscale ... [ ok ]
+ set +x
Installation complete![...]
 * status: started
Failed to connect to local Tailscale daemon for /localapi/v0/status; not running? Error: dial unix /var/run/tailscale/tailscaled.sock: connect: no such file or directory
 3385 root      0:00 supervise-daemon tailscale --start --stdout /var/log/tailscaled.log --stderr /var/log/tailscaled.log --pidfile /run/tailscale.pid --respawn-delay 2 --respawn-max 5 --respawn-period 1800 --capabilities ^cap_net_admin,cap_net_raw --user root tailscale /usr/sbin/tailscaled -- --socket=/run/tailscale/tailscaled.sock --state=/var/lib/tailscale/tailscaled.state --port=41641 --verbose=0 --no-logs-no-support

After reboot, I can properly setup tailscale.

Is this an issue, that can generally be addressed? Like is it related to alpine and I could try another OS, or is this just not possible without reboot?

Answer 1

Does the kernel get upgraded on first boot?

@tom-yan pretty much got it

I just ran into the same error with tun and found this post

The problem was this kernel package getting upgraded by apk upgrade:
linux-virt-6.12.46-r0 aarch64 {linux-lts} (GPL-2.0-only) [upgradable from: linux-virt-6.12.38-r0]

To get around this, I used --ignore for the apk upgrade command in my cloud-init script

I see in your cloud-init script you have this:

package_update: true
package_upgrade: true
package_reboot_if_required: true

Instead, in my cloud-init script I did this in the runcmd block:

runcmd:
  # Update and upgrade packages (ignore kernel packages)
  - apk update --force-refresh
  - apk upgrade --ignore linux-lts linux-lts-headers