Tailscale Kernel TUN in Unprivileged LXC: Direct SSH Without Userspace Networking
tailscale up --tun=userspace-networking gets you a green dot in the admin console and almost nothing else. The node appears in your tailnet, tailscale status looks healthy, and then you try to SSH into that container from your laptop and the connection hangs until TCP gives up. Two lines in the LXC config file fix it, and the container stays unprivileged. That's the whole post, really. But those…
The story "Tailscale Kernel TUN in Unprivileged LXC: Direct SSH Without Userspace Networking" explains how to enable direct SSH connections to unprivileged LXC containers running on Tailscale without using userspace networking. The issue arises when using the `--tun=userspace-networking` option, which sets up a network interface for Tailscale but does not allow direct SSH connections to the container.
Two lines in the LXC configuration file resolve the problem, but only after understanding why guides recommend using userspace networking. This approach simplifies the setup by avoiding the need for a kernel TUN device, but it introduces several drawbacks. Outbound traffic requires a proxy, which can lead to silent failures if not configured correctly. Inbound traffic to normal daemons is also impossible, as packets arrive inside tailscaled's netstack and have no path to a kernel-owned socket.
UDP support in Tailscale's netstack has been limited, causing issues with applications like mosh that rely on UDP datagrams. The main problem lies in the combination of conditions that must be met for direct SSH connections to work: the host must have the tun module loaded, the container's device cgroup must allow access to the tun device, and the device node must be bind-mounted into the container's filesystem.
The solution involves loading the tun module on the host, persisting it using a configuration file, and creating a bind mount from /dev/net/tun into the container's filesystem. This ensures the kernel TUN device is available for Tailscale to use in unprivileged LXC containers. Following these steps allows direct SSH connections to unprivileged LXC containers without relying on userspace networking, providing a more secure and reliable setup.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
