Tailscale
Install the Tailscale client into an existing LXC container from the Proxmox VE host.
add-tailscale-lxc.sh gives an existing container access to /dev/net/tun
and installs the Tailscale package inside it. It does not join the container
to a tailnet.
| Run it | On the Proxmox VE host. require_pve_host exits with code 232 anywhere else |
| Target | An existing LXC container picked from a list |
| Container OS | Debian, Ubuntu, Alpine. Anything else exits with code 238 |
| Port | None |
| Source | tools/addon/add-tailscale-lxc.sh |
Run
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/add-tailscale-lxc.sh)"Prompts
| Prompt | Answer |
|---|---|
This will add Tailscale to an existing LXC Container ONLY. Proceed (y/n)? | y continues, n exits. Anything else asks again |
Select a container to add Tailscale to: (list titled Containers on <node>) | Pick one container from pct list. Cancel exits without changes |
What it changes
On the host:
-
Starts the container if it is not running and waits up to 30 seconds for a default route.
-
Adds two lines to
/etc/pve/lxc/<CTID>.conf, each only if it is not there yet:lxc.cgroup2.devices.allow: c 10:200 rwm lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file -
Appends the tag
tailscaleto the container's existing tags withpct set.
Inside the container:
| Container OS | Steps |
|---|---|
| Alpine | Installs bash if missing, enables the community repository in /etc/apk/repositories if it is not enabled, runs apk add tailscale, then rc-update add tailscale default and rc-service tailscale start |
| Debian / Ubuntu | Installs curl if missing, removes the old /usr/share/keyrings/tailscale-archive-keyring.gpg, adds the pkgs.tailscale.com/stable repository with setup_deb822_repo, installs the tailscale package |
On Debian and Ubuntu the script first checks whether pkgs.tailscale.com
resolves (with dig, host, nslookup or getent, whichever exists). If the
lookup fails or returns a blocked address, it copies /etc/resolv.conf to
/tmp/resolv.conf.backup, writes nameserver 1.1.1.1 for the duration of the
install, and moves the backup back afterwards.
No credentials are created.
After the install
Reboot the container so the new device entries apply, then run inside it:
tailscale upUpdate
The script has no update path and installs no update_ helper. Tailscale comes
from a package repository, so it is updated by the container's package manager
(apt or apk).
Remove
The script has no uninstall path. Removing Tailscale means removing the package inside the container and deleting the two lines and the tag from the container configuration by hand.
Limits
- Only LXC containers on the node you run it on are listed.
- The script installs the client only. Authentication, exit nodes and subnet
routing are configured with
tailscale upafterwards.