Is there a reason Tailscale doesn't automatically set up an LXC for you like some other helper scripts do?

[robmonte]

I'm really new to Proxmox and Linux home servers in general. I noticed the Tailscale helper webpage says You can use it inside a running LXC container or directly on the Proxmox VE host to extend functionality with Tailscale. However it provides no context for this statement. Is there a benefit to installing on the host directly? Drawbacks?

As "helper scripts", I've so far kinda leaned on the scripts taking care of setup of LXC's and VM's for me. I like looking through the scripts to see how it's setting things up to build up my understanding of thing, but know it's figured out already. It also helps me gain a better estimation for what kind of default hardware resource allocations the different types of services need. Tailscale themselves seems to have a good video guide on installing Tailscale on an LXC manually, so I'm not sure how to weigh which option is better overall for users like me.

[MickLesk]

Tailscale is implemented as an addon because it’s not a standalone service — it simply extends an existing system into your Tailnet.
Creating a dedicated LXC by default would add unnecessary infrastructure when many users just want their existing container or host reachable.
Most people want to attach Tailscale to something that already runs (a service LXC or the Proxmox host).
As an addon, it keeps the architecture flexible: host, existing LXC, or a dedicated router container are all valid options.
A forced “Tailscale appliance LXC” would only cover one of several legitimate use cases.
It also avoids creating extra containers for a lightweight daemon.
Tailscale requires TUN support regardless of deployment model, so addon vs. LXC doesn’t change that.
The design choice favors integration over additional infrastructure.
If someone prefers strict separation, they can still create a dedicated LXC intentionally.
It’s about flexibility, not avoiding LXC.

[robmonte]

Thanks for the insight. I think I mainly want Tailscale to function as an exit node to the internet when connecting from outside my home. At least (for now) I am not worried about trying to connect to my Proxmox machine or anything running on it from outside my home network. I'm not sure if this changes anything regarding security or other things, such that would make it better to have it running in a container instead of directly on my Proxmox host?

[MickLesk]

If you only want an exit node, running Tailscale in a dedicated LXC is actually the better architectural choice.
There is no benefit to installing it directly on the Proxmox host in that scenario.
An exit node just needs outbound internet and IP forwarding — it does not need hypervisor-level access.
Keeping it in an LXC maintains isolation and follows the “keep the host minimal” best practice.
If something is misconfigured (IP forwarding, firewall, ACLs), you’re not affecting the management layer of Proxmox.
From a security standpoint, isolating an internet-exposed exit node from the hypervisor is strictly cleaner.
Performance difference is negligible for typical home bandwidth.
TUN support is required either way.

So in his case:
If the goal is only exit node functionality → recommend a small dedicated LXC.

Installing on the host only makes sense if he also wants guaranteed direct access to the Proxmox management layer itself via Tailscale.