# DockTail automates Tailscale Services for Docker containers with Compose labels

> **Key takeaway:** DockTail bridges Docker Compose and Tailscale Services by watching container events and automatically registering labeled apps as named HTTPS endpoints, eliminating manual port management and console configuration.

**Published:** 2026-11-04T06:36:35+00:00 
**Source:** It's FOSS Community News 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/docktail-automates-tailscale-services-for-docker-containers-.html 

## Summary
Marvin von Rappard has released DockTail, an open-source Go tool that automates Tailscale Services for Docker homelab environments. The project addresses the friction of managing dozens of containerized applications across multiple hosts, where users previously relied on IP:port bookmarks or complex reverse proxy setups. Tailscale Services provides named virtual endpoints like jellyfin.your-tailnet.ts.net that route to applications rather than machines, but manual setup requires console configuration and per-app tailscale serve commands. DockTail eliminates this by reading Docker labels directly from Compose files, watching Docker events for container lifecycle changes, and automatically creating or removing Service definitions via the Tailscale API.

The tool runs as a single container per host with access to the Docker socket and Tailscale daemon socket, using OAuth credentials scoped for Services and Devices write access. Applications no longer need published ports on the host; DockTail points Tailscale directly at container IPs on internal Docker networks. The project is licensed under AGPL-3.0 and includes documentation for common apps including Jellyfin and Home Assistant, which require specific proxy header trust configuration due to Tailscale's X-Forwarded-For handling.

## How DockTail wires Docker labels to Tailscale Services
- **Service abstraction vs. machine-centric networking:** Tailscale Services assigns a virtual IP and DNS name to an application rather than a device, allowing multiple machines to advertise the same endpoint while access rules target the Service directly rather than granting blanket host access.
- **Label-driven automation:** DockTail parses Docker labels including `docktail.service.enable=true`, `docktail.service.name`, `docktail.service.port`, and `docktail.service.service-port` from Compose files, eliminating the need for separate console configuration and tailscale serve commands per application.
- **Container-native routing without published ports:** The tool targets container IPs directly on Docker bridge networks rather than host-published ports, which requires dynamic reconfiguration when containers are recreated and necessitates Docker event monitoring to maintain accurate Service mappings.
- **OAuth-based API integration:** DockTail uses Tailscale OAuth clients with Services:Write and Devices Core:Write permissions scoped to tagged hosts, enabling automatic Service creation and removal without manual admin console approval when auto-approver policies are configured.
- **Proxy header behavior and application compatibility:** Tailscale's tailscaled terminates HTTPS and forwards plain HTTP with X-Forwarded-For headers, requiring applications like Home Assistant and Jellyfin to explicitly trust the proxy through configuration.yaml or dashboard networking settings to avoid 400 Bad Request responses.

## Why it matters
DockTail fills a gap in the container networking toolchain by bringing Traefik-style label automation to Tailscale's zero-trust mesh, making self-hosted homelab and small-scale infrastructure more maintainable for Linux users who rely on Docker Compose. For system administrators and developers running private services without public domains, it reduces operational overhead and configuration drift by colocating network exposure with application definitions. The AGPL-3.0 license and use of standard Tailscale APIs also provides a reference pattern that could inspire similar integrations for Podman, Kubernetes, or other container runtimes in the open-source ecosystem.