Unleash your Containers as Tailscale Services

Add labels to your Docker containers. DockTail handles the rest.

Uses native Tailscale Services, not per-container Tailscale devices.

Get Started GitHub
docker-compose.yml
services:
  myapp:
    image: nginx:latest
    # No ports needed!
    labels:
      - "docktail.service.enable=true"
      - "docktail.service.name=myapp"
      - "docktail.service.port=80"
https://myapp.tailnet.ts.net
Service is live
myapp.tailnet.ts.net
Tailscale HTTPS

DockTail vs alternatives

DockTail gives Docker containers the native Tailscale Services model without turning each app into another Tailscale device.

DockTail TSDProxy ScaleTail tsbridge Plain Services
Native Tailscale Services ✅ ❌ ❌ ❌ ✅
Configured via Docker labels ✅ ✅ ❌ ✅ ❌
Apps do not consume separate Tailscale device slots iDockTail advertises apps as services from one tagged host instead of creating a separate Tailscale device identity per app. Exact plan limits depend on Tailscale. ✅ ❌ ❌ ❌ ✅
No app port publishing ✅ ⚠️iDepends on proxy and Docker network setup. ⚠️iDepends on the sidecar template and app network setup. ⚠️iDepends on proxy and Docker network setup. ⚠️iYou configure how the service host reaches the backend yourself.
Automatic Docker reconciliation ✅ ✅ ❌ ✅ ❌
Low manual setup after install ✅ ✅ ⚠️iScaleTail is template-based, so each app usually starts from its own Compose recipe. ✅ ❌

Features

Auto Discovery

Monitors Docker events in real-time. Start a labeled container and it appears on your Tailnet within seconds.

Direct IP Proxy

No port publishing required. Routes directly to container IPs on the Docker network, adapting automatically on restart.

Funnel Support

Expose any container to the public internet via Tailscale Funnel. One label takes you from private to public.

How it works

1

Add docktail.* labels to your container

2

DockTail detects and advertises to Tailscale

3

Access via service.tailnet.ts.net