mirror of
https://github.com/tailscale/tailscale.git
synced 2025-12-22 13:37:10 +00:00
723b9af21a
Re-instate the linking of iptables installed in Tailscale container to the legacy iptables version. In environments where the legacy iptables is not needed, we should be able to run nftables instead, but this will ensure that Tailscale keeps working in environments that don't support nftables, such as some Synology NAS hosts. Updates #17854 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
83 lines
2.7 KiB
Docker
83 lines
2.7 KiB
Docker
# Copyright (c) Tailscale Inc & AUTHORS
|
|
# SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
# Note that this Dockerfile is currently NOT used to build any of the published
|
|
# Tailscale container images and may have drifted from the image build mechanism
|
|
# we use.
|
|
# Tailscale images are currently built using https://github.com/tailscale/mkctr,
|
|
# and the build script can be found in ./build_docker.sh.
|
|
#
|
|
# If you want to build local images for testing, you can use make.
|
|
#
|
|
# To build a Tailscale image and push to the local docker registry:
|
|
#
|
|
# $ REPO=local/tailscale TAGS=v0.0.1 PLATFORM=local make publishdevimage
|
|
#
|
|
# To build a Tailscale image and push to a remote docker registry:
|
|
#
|
|
# $ REPO=<your-registry>/<your-repo>/tailscale TAGS=v0.0.1 make publishdevimage
|
|
#
|
|
# This Dockerfile includes all the tailscale binaries.
|
|
#
|
|
# To build the Dockerfile:
|
|
#
|
|
# $ docker build -t tailscale/tailscale .
|
|
#
|
|
# To run the tailscaled agent:
|
|
#
|
|
# $ docker run -d --name=tailscaled -v /var/lib:/var/lib -v /dev/net/tun:/dev/net/tun --network=host --privileged tailscale/tailscale tailscaled
|
|
#
|
|
# To then log in:
|
|
#
|
|
# $ docker exec tailscaled tailscale up
|
|
#
|
|
# To see status:
|
|
#
|
|
# $ docker exec tailscaled tailscale status
|
|
|
|
|
|
FROM golang:1.25-alpine AS build-env
|
|
|
|
WORKDIR /go/src/tailscale
|
|
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
# Pre-build some stuff before the following COPY line invalidates the Docker cache.
|
|
RUN go install \
|
|
github.com/aws/aws-sdk-go-v2/aws \
|
|
github.com/aws/aws-sdk-go-v2/config \
|
|
gvisor.dev/gvisor/pkg/tcpip/adapters/gonet \
|
|
gvisor.dev/gvisor/pkg/tcpip/stack \
|
|
golang.org/x/crypto/ssh \
|
|
golang.org/x/crypto/acme \
|
|
github.com/coder/websocket \
|
|
github.com/mdlayher/netlink
|
|
|
|
COPY . .
|
|
|
|
# see build_docker.sh
|
|
ARG VERSION_LONG=""
|
|
ENV VERSION_LONG=$VERSION_LONG
|
|
ARG VERSION_SHORT=""
|
|
ENV VERSION_SHORT=$VERSION_SHORT
|
|
ARG VERSION_GIT_HASH=""
|
|
ENV VERSION_GIT_HASH=$VERSION_GIT_HASH
|
|
ARG TARGETARCH
|
|
|
|
RUN GOARCH=$TARGETARCH go install -ldflags="\
|
|
-X tailscale.com/version.longStamp=$VERSION_LONG \
|
|
-X tailscale.com/version.shortStamp=$VERSION_SHORT \
|
|
-X tailscale.com/version.gitCommitStamp=$VERSION_GIT_HASH" \
|
|
-v ./cmd/tailscale ./cmd/tailscaled ./cmd/containerboot
|
|
|
|
FROM alpine:3.22
|
|
RUN apk add --no-cache ca-certificates iptables iproute2 ip6tables
|
|
RUN rm /usr/sbin/iptables && ln -s /usr/sbin/iptables-legacy /usr/sbin/iptables
|
|
RUN rm /usr/sbin/ip6tables && ln -s /usr/sbin/ip6tables-legacy /usr/sbin/ip6tables
|
|
|
|
COPY --from=build-env /go/bin/* /usr/local/bin/
|
|
# For compat with the previous run.sh, although ideally you should be
|
|
# using build_docker.sh which sets an entrypoint for the image.
|
|
RUN mkdir /tailscale && ln -s /usr/local/bin/containerboot /tailscale/run.sh
|