Linux Jails (sandboxes / containers) with Jailmaker

[Stux]

Some people install Tailscale/Wireguard in its own jail using host networking

Linux Jails (sandboxes / containers) with Jailmaker

Nothing special, except for inserting this when jlmkr asks for “Additional flags”: –capability=CAP_NET_ADMIN When the jail starts, shell into it, then apt install curl curl -fsSL https://tailscale.com/install.sh | sh tailscale up -authkey [your auth key] It just works. I’m aware that using simple host networking (instead of --network-macvlan or --network-bridge) is frowned upon, but in my specific case - using Tailscale to manage the host itself - it seemed the easiest way.

Others run it in host mode

Running tailscale in a jail: trick was network_mode: host

I love the new jail functionality. So following the excellent tutorial by capt stux (see this youtube video on jailmaker on truenas scale), i created a stack for tailscale. I tore my hair out for 30 minutes because I couldn’t access any of the ports on docker remotely via tailscale. The simplest solution is to use Host Network. This is a checkbox in the app version of tailscale. With jlmkr, I’m using Dockge as recommended in the video. Here is the compose.yaml file I use with tailscale which …

Others add the right caps

WireGuard on Linux ‘jail’ with systemd-nspawn

Tailscale simply works, running their install script - the only thing needed is the --capability=CAP_NET_ADMIN argument in the jail config. Anyway, I did manage to get WireGuard running for now as a docker container inside a jail, following this link: GitHub - linuxserver/docker-wireguard It takes a couple minutes to accept connections when the jail is restarted, but it is enough for my current needs. I’ll investigate further how to do this without docker, as a side project.