marvinvr/docktail

What is it?

Key features

• 01Discovers containers automatically from docktail.* labels.
• 02Creates Tailscale services using OAuth or API key credentials.
• 03Supports HTTP, HTTPS, TCP and TLS-terminated TCP.
• 04Offers optional PROXY protocol so backends see the tailnet client IP.
• 05Provides Tailscale Funnel for public internet access.
• 06Lets one container expose multiple services and reconciles them on restart.

Use cases

• Publishing a homelab web app over Tailscale HTTPS without opening host ports.
• Exposing a database to tailnet clients over TCP.
• Running a reverse proxy that needs the real tailnet client IP via PROXY protocol.
• Making a webhook endpoint reachable publicly through Tailscale Funnel.

Quick start

1. 1

   Add a docktail compose service with the Docker socket and Tailscale OAuth variables, and label your app containers

2. 2

   Start the stack

   docker compose up -d
3. 3

   Open the app from your tailnet

   curl http://myapp.your-tailnet.ts.net

Things to know

• !Licensed under AGPL-3.0, a copyleft license that requires source disclosure for modified network services.
• !Requires the Docker host to be connected to Tailscale and allowed to advertise services.
• !Automatic service creation needs Tailscale OAuth or API key credentials.
• !Mounting the Docker socket gives the container access to the host's Docker daemon.

In collections

Topics

FAQ

What is docktail?

Exposes Docker containers as Tailscale Services using docktail.* labels, without per-container Tailscale devices or published ports. DockTail watches Docker containers, reads docktail.* labels, and publishes matching containers as native Tailscale Services. Apps do not need published Docker ports by default, because DockTail proxies directly to their Docker network IPs.

Is docktail free to use? What license does it have?

docktail is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.

Is docktail still maintained?

Actively maintained. The last commit to docktail was on Nov 5, 2026.

What can I use docktail for?

Publishing a homelab web app over Tailscale HTTPS without opening host ports. Exposing a database to tailnet clients over TCP. Running a reverse proxy that needs the real tailnet client IP via PROXY protocol. Making a webhook endpoint reachable publicly through Tailscale Funnel.

How do I install docktail?

Add a docktail compose service with the Docker socket and Tailscale OAuth variables, and label your app containers Start the stack: docker compose up -d Open the app from your tailnet: curl http://myapp.your-tailnet.ts.net

Where can I get docktail?

The source code and installation instructions are on GitHub: https://github.com/marvinvr/docktail