Tailscale in a container

Add a container to your own Tailscale network with one click, so the AI in your chats can reach machines inside it, such as a home server or a database behind your firewall. You sign in at Tailscale. ZeroLog never sees your password and never stores a Tailscale auth key for this.

The container reaches your tailnet, never the other way round, and only while the connection is live.

Diagram as text

Open the container overview, find the Tailnet section and press Connect to Tailscale.
A new tab opens and shows the Tailscale sign-in. On a cold start this can take up to 3 minutes.
Sign in at Tailscale. ZeroLog never sees your password.
If the sign-in is not finished within 10 minutes, the attempt ends.
The container joins your tailnet as an ephemeral device, in userspace networking with shields-up, so nothing can connect into it.
The AI reads a read-only device list at /tmp/zl-tailnet-status.json and reaches devices through the SOCKS5 proxy at 127.0.0.1:1055.
The connection ends on Disconnect, when the container pauses or restarts, or after 4 hours by default.

Where: open a running container and find the Tailnet section in its overview. You need to be the owner, have a plan with containers (Mini or higher) and the Tailscale permission, which new accounts have.
Connect: press Connect to Tailscale. A new tab opens and shows the Tailscale sign-in. If the work environment is still starting, this can take up to 3 minutes; the tab fills itself in. Sign in there and the view notices on its own, then shows the device name, your tailnet and its 100.x address. Cancel ends the attempt while it waits.
Time limits: finish the sign-in within 10 minutes or the attempt ends. A connection lasts 4 hours by default, and the view shows when it ends. It also ends when the container pauses or restarts. Connect again afterwards. You can start 10 attempts per 10 minutes.
Disconnect signs the device out of Tailscale and stops it. If Tailscale does not confirm the sign-out, the device drops out of your tailnet shortly on its own.
One direction only. The container reaches your tailnet; your devices cannot reach the container (shields-up). It runs in userspace networking, with no subnet routes and no exit node. The device is ephemeral: it disappears from your tailnet when the connection ends. Its name comes from the container name.
What the AI sees: a read-only list of your devices (name, system, online state, addresses) in /tmp/zl-tailnet-status.json, refreshed by ZeroLog. It reaches a device through the local SOCKS5 proxy at 127.0.0.1:1055, for example curl --socks5-hostname 127.0.0.1:1055 http://name:port. The list holds no login link and no keys.
No Tailscale command for the agent. The tailscale CLI is not available to the AI by design, so a failing tailscale status does not mean the connection is off.

This is separate from the key proxy, which can hold a Tailscale API token, and from desktop control, which works on your own computer. Container traffic otherwise follows outbound network rules. This describes the released behaviour; a full sign-in on a customer account has not been recorded yet, so tell us if it fails.