<!-- https://zerolog.ch/docs/tailnet · Docs / Compute -->
# Tailscale in a container

Add a container to your own Tailscale network with one click, so the AI in your chats can reach machines inside it, such as a home server or a database behind your firewall. You sign in at Tailscale. ZeroLog never sees your password and never stores a Tailscale auth key for this.

- **Where:** open a running container and find the **Tailnet** section in its overview. You need to be the owner, have a plan with containers (Mini or higher) and the Tailscale permission, which new accounts have.
- **Connect:** press **Connect to Tailscale**. A new tab opens and shows the Tailscale sign-in. If the work environment is still starting, this can take up to 3 minutes; the tab fills itself in. Sign in there and the view notices on its own, then shows the device name, your tailnet and its 100.x address. **Cancel** ends the attempt while it waits.
- **Time limits:** finish the sign-in within 10 minutes or the attempt ends. A connection lasts 4 hours by default, and the view shows when it ends. It also ends when the container pauses or restarts. Connect again afterwards. You can start 10 attempts per 10 minutes.
- **Disconnect** signs the device out of Tailscale and stops it. If Tailscale does not confirm the sign-out, the device drops out of your tailnet shortly on its own.
- **One direction only.** The container reaches your tailnet; your devices cannot reach the container (shields-up). It runs in userspace networking, with no subnet routes and no exit node. The device is ephemeral: it disappears from your tailnet when the connection ends. Its name comes from the container name.
- **What the AI sees:** a read-only list of your devices (name, system, online state, addresses) in `/tmp/zl-tailnet-status.json`, refreshed by ZeroLog. It reaches a device through the local SOCKS5 proxy at `127.0.0.1:1055`, for example `curl --socks5-hostname 127.0.0.1:1055 http://name:port`. The list holds no login link and no keys.
- **No Tailscale command for the agent.** The `tailscale` CLI is not available to the AI by design, so a failing `tailscale status` does not mean the connection is off.

This is separate from the [key proxy](https://zerolog.ch/docs/keyproxy), which can hold a Tailscale API token, and from [desktop control](https://zerolog.ch/docs/desktop), which works on your own computer. Container traffic otherwise follows [outbound network](https://zerolog.ch/docs/egress) rules. This describes the released behaviour; a full sign-in on a customer account has not been recorded yet, so tell us if it fails.

## Connecting a container to your tailnet

Mermaid source of the diagram on this page:

```mermaid
%% Tailnet in a container: from the click to the AI reaching your devices. Facts from server/tailnet-runtime.js, server/tailscale.js, web/apps/web/components/containers/tailnet-panel.tsx.
flowchart TB
  a["1. Container overview<br/>Tailnet section<br/>Connect to Tailscale"]
  b["2. New tab opens<br/>Tailscale sign-in<br/>up to 3 min on a cold start"]
  c["3. You sign in at Tailscale<br/>ZeroLog never sees<br/>your password"]
  d["4. Connected<br/>ephemeral device<br/>userspace, shields-up<br/>no inbound"]:::hot
  e["5. The AI reads<br/>/tmp/zl-tailnet-status.json<br/>and uses SOCKS5<br/>127.0.0.1:1055"]
  f["Ends: Disconnect,<br/>pause, restart<br/>or after 4 h"]
  x["Sign-in not finished<br/>after 10 min:<br/>attempt ends"]

  a --> b --> c
  c --> d
  c -->|too slow| x
  d --> e
  d --> f

  classDef hot stroke:#8f7ac9
```