{
  "id": 2512692,
  "title": "Tailscale Kernel TUN in Unprivileged LXC: Direct SSH Without Userspace Networking",
  "url": "https://urgent.news/2026/08/22/tailscale-kernel-tun-in-unprivileged-lxc-direct-ssh-without-userspace",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-22T06:15:48.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/futhgar/tailscale-kernel-tun-in-unprivileged-lxc-direct-ssh-without-userspace-networking-18la"
  },
  "original_language": "en",
  "account": "The story \"Tailscale Kernel TUN in Unprivileged LXC: Direct SSH Without Userspace Networking\" explains how to enable direct SSH connections to unprivileged LXC containers running on Tailscale without using userspace networking. The issue arises when using the `--tun=userspace-networking` option, which sets up a network interface for Tailscale but does not allow direct SSH connections to the container.\n\nTwo lines in the LXC configuration file resolve the problem, but only after understanding why guides recommend using userspace networking. This approach simplifies the setup by avoiding the need for a kernel TUN device, but it introduces several drawbacks. Outbound traffic requires a proxy, which can lead to silent failures if not configured correctly. Inbound traffic to normal daemons is also impossible, as packets arrive inside tailscaled's netstack and have no path to a kernel-owned socket.\n\nUDP support in Tailscale's netstack has been limited, causing issues with applications like mosh that rely on UDP datagrams. The main problem lies in the combination of conditions that must be met for direct SSH connections to work: the host must have the tun module loaded, the container's device cgroup must allow access to the tun device, and the device node must be bind-mounted into the container's filesystem.\n\nThe solution involves loading the tun module on the host, persisting it using a configuration file, and creating a bind mount from /dev/net/tun into the container's filesystem. This ensures the kernel TUN device is available for Tailscale to use in unprivileged LXC containers. Following these steps allows direct SSH connections to unprivileged LXC containers without relying on userspace networking, providing a more secure and reliable setup.",
  "summary": "tailscale up --tun=userspace-networking gets you a green dot in the admin console and almost nothing else. The node appears in your tailnet, tailscale status looks healthy, and then you try to SSH into that container from your laptop and the connection hangs until TCP gives up. Two lines in the LXC config file fix it, and the container stays unprivileged. That's the whole post, really. But those…",
  "key_points": [],
  "editors_take": "Allowing direct SSH connections to unprivileged LXC containers without userspace networking enhances security and reliability by eliminating the need for a proxy and enabling inbound traffic to normal daemons.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}