# tailnet Published articles for tailnet. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## I Got Tired of Remembering Ports for 30 Docker Apps in My Homelab. Here's How I Fixed it DevFeed: [I Got Tired of Remembering Ports for 30 Docker Apps in My Homelab. Here's How I Fixed it]() Original publisher: [Read original article]() Author: Community Published: 2026-11-04T06:36:35Z Content type: tutorial Language: en Sources: [It's FOSS]() Topics: [tailscale](), [Homelab](), [Docker](), [Docker Compose](), [traefik]() Tags: [access-controls](), [apps](), [certificates](), [clients](), [compose](), [config](), [configuration](), [containers](), [docker](), [docker-container](), [homelab](), [https](), [ip](), [proxy](), [reverse](), [reverse-proxy](), [services](), [sidecar](), [tailnet](), [tailscale]() ### AI overview Tailscale Services give Docker apps their own HTTPS names on a tailnet while keeping them off the Machines list. A host advertises each Service; `tailscaled` terminates HTTPS and forwards plain HTTP to the app, adding `X-Forwarded-For`. Manual setup requires a tagged host, suitable tag policy and approval, and a `tailscale serve` command per app; published host ports are needed for that route. DockTail automates Service creation and routing from Docker labels, watches container events, and can target container IPs without published ports. It requires Docker socket access, Tailscale state access, and an OAuth client with Services: Write and Devices Core: Write scoped to the host tag. Apps that validate proxy headers may need trusted proxy settings. The author prefers this for changing homelabs because Compose labels track app lifecycle, while noting manual setup is adequate for a few stable containers and a reverse proxy remains preferable for public services on a custom domain. ### Source excerpt Stop bookmarking IP:ports. Tailscale Services gives every Docker container in your homelab its own HTTPS name on your tailnet, without a reverse proxy or a sidecar per container. ## Tailscale SSH Security Findings: What Self-Hosters Need to Know DevFeed: [Tailscale SSH Security Findings: What Self-Hosters Need to Know]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-11-02T04:20:54Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [ssh](), [tailscale](), [Access Control](), [Security](), [Homelab](), [Self-hosted]() Tags: [attack](), [authentication](), [credentials](), [device](), [disclosure](), [exploit](), [exploitation](), [fixed](), [funnel](), [homelab](), [initial-access](), [network-security](), [network-security-news](), [news](), [security](), [security-findings](), [self-hosted](), [serve](), [ssh](), [tailnet](), [tailscale](), [tailscale-ssh](), [tailscale-ssh-vulnerability](), [version]() ### AI overview Three confirmed Tailscale SSH security issues, also affecting Serve and Funnel, were fixed in v1.104.4; two other findings were judged intentional. The described risk is privilege escalation in an already authenticated SSH session, including through forwarding, and requires both an attacker foothold on an authorized tailnet peer and an ACL that permits that peer to use Tailscale SSH. The text characterizes this as lateral movement, not unauthenticated initial access. It recommends updating every device to v1.104.4 or later, reviewing SSH ACL permissions, and considering SSH check mode, which requires re-authentication before granting a session. A separate Conn25 issue affects a pre-production feature; the article says stable app connectors currently available are unaffected. ### Source excerpt Tailscale has disclosed a set of security findings affecting Tailscale SSH, plus the related Serve and Funnel features, and has already shipped fixes in version 1.104.4. If you run Tailscale on a homelab or self-hosted tailnet, here's what happened, what it does (and doesn't) mean for your setup, and what to do next. What Tailscale [...]