So Tailscale has this whole series about hosting services on one’s Tailnet using Docker. Their approach is to run Tailscale in Docker and have the services’ containers share its namespace by setting network_mode: service:<tailscale_service_name>.
I am trying to understand why this is better than just binding the service’s port to the Tailscale IP of the host device, given that option is not even mentioned in any of their blog posts.
The only advantage I can think of is that you get to have different Tailscale rules/configurations for different services. In my case, this is not an advantage because I will run Tailscale on the host anyway and I won’t have different configurations for each service.
Can anyone help me understand?
Maybe you get the possibility of routing all traffic from a container (or all the containers in that namespace/network) over the tailnet this way? With the host method, you’d need the host to use the exit node too.