Unraid tailscale

[baldygeraldy]

Describe the feature you would like to see

Unraid has a built in tailscale feature and it works with all containers i have except dozzle. I am uncertain why but i assume it’s because the dozzle container is so lightweight and doesn’t have certain packages or dependencies. Was hoping you realized a version so that tailscale can be used on unraid with dozzle.

Describe how you would like to see this feature implemented

No response

Describe any alternatives you've considered

No response

[amir20]

I don't understand this. I don't have Unraid but others have reported it works and tailscale is supported. You'll have to do the investigation yourself.

[msfrox]

Unraid's Tailscale integration bind-mounts a host script over /opt/unraid/tailscale and makes it the container entrypoint. That script is #!/bin/sh. amir20/dozzle is built FROM scratch — just the binary and a CA bundle, no shell. So exec /opt/unraid/tailscale: no such file or directory (the missing file is the interpreter, not the hook). There is no shell-bearing Dozzle tag,

[msfrox]

Following up on my own comment above — it got truncated when I posted it, and in any case I've since solved this. No Dozzle change is needed.

Completing the thought: there is no shell-bearing Dozzle tag, so my first attempt was to repackage the binary onto Alpine myself. That works but forks the image — Dozzle releases stop arriving through Unraid/CA auto-update and every upgrade becomes a manual rebuild. I've thrown that away for something better.

The Unraid hook has an escape hatch. It only shells out to apk/apt/pacman + wget + jq to install Tailscale if /usr/bin/tailscale and /usr/bin/tailscaled are missing. Put them there and it skips that entire block:

Executing Unraid Docker Hook for Tailscale

Tailscale found, continuing...

So the fix is to bind-mount the missing pieces in read-only, and leave the image completely alone:

Host	Container	What it is
<shim>/bin/busybox	/bin/sh	static musl busybox — the interpreter
<shim>/bin	/usr/bin	busybox applet symlinks + static jq + tailscale/tailscaled

Plus --tmpfs /var/log in Extra Parameters — the hook does >>/var/log/tailscaled, and that redirect fails if the directory doesn't exist, which kills tailscaled and silently degrades you to a running-but-not-on-the-tailnet container.

Build the shim on the Unraid host:

mkdir -p /mnt/user/appdata/ts-shim/bin && cd /mnt/user/appdata/ts-shim/bin

# static busybox
CID=$(docker create busybox:musl); docker cp $CID:/bin/busybox ./busybox; docker rm $CID
for a in sh id which echo cat sed grep tr head tail sleep timeout mkdir cp rm date hostname kill tar env; do ln -sf busybox $a; done

# static jq — busybox has no jq applet, and the hook parses `tailscale status --json` on every start
curl -fsSL -o jq https://github.com/jqlang/jq/releases/latest/download/jq-linux-amd64 && chmod +x jq

# tailscale binaries — reuse the ones the Unraid Tailscale plugin already installed
cp /usr/local/sbin/tailscale /usr/local/sbin/tailscaled . && chmod +x tailscale tailscaled

Then add those two mounts to the Dozzle template and enable Tailscale as normal (Userspace Networking on). Result, on stock amir20/dozzle:latest:

Settings Tailscale state dir to: /data/.tailscale_state
Enabling userspace networking! Tailscale DNS not available
Setting host name to "dozzle"
Starting tailscaled with log file location: /var/log/tailscaled
Starting tailscale
Enabling Serve! See https://tailscale.com/kb/1312/serve
Available within your tailnet:
https://dozzle.<tailnet>.ts.net/
|-- proxy http://localhost:8080
Serve started and running in the background.
Starting container...
{"level":"info","version":"v10.6.15","message":"Dozzle version v10.6.15"}

Because the container is still running the upstream image, auto-update works again — mine picked up v10.6.15 on the very first recreate.

Three things that cost me time, if you try this:

• Everything injected must be fully static — a scratch image has no loader and no libc. Don't verify with ldd: it exits 0 and prints "statically linked" for a static-pie binary, so a broken check passes. Use readelf -l (no program interpreter) and readelf -d (no NEEDED).
• Recreate with update_container <Name> ca_docker_run_override, not rebuild_container. Only update_container injects ORG_ENTRYPOINT. Without it the hook runs a bare exec, falls off the end of the script, and the container exits 0 after ~12s with no log output at all — a genuinely baffling failure.
• Keep Userspace Networking on. In TUN mode tailscaled takes a real network stack in the container namespace, binds <tailnet-ip>:443 and rewrites /etc/resolv.conf to 100.100.100.100, which breaks Docker's embedded DNS at 127.0.0.11. That bit me on a different container, not Dozzle, but it's the same toggle.

I refresh the shim from a nightly cron job so the Tailscale binaries track the host plugin.

@amir20 — you were right that this is an Unraid-side problem and doesn't need anything from you. The only thing that would help the next person is an optional shell-bearing tag; I'll raise that separately as a low-priority convenience request rather than reopening this, and it's entirely reasonable to say no to it.