Tailscale and LXC Container: Running It in Proxmox Without the Headache

Tailscale and LXC container setups on Proxmox are mostly fine, but the TUN device and capabilities trip people up. You’ll see a lot of old forum posts saying to add /dev/net/tun and call it a day. That’s not enough anymore, especially on unprivileged containers.

Privileged container: the easy path

If you don’t care about security isolation, just use a privileged container. It’s simpler. Create the container normally, then edit its config file at /etc/pve/lxc/<CTID>.conf and add:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

That gives the container access to the TUN device. Then install Tailscale inside the container:

curl -fsSL https://tailscale.com/install.sh | sh
tailscale up

That’s it. It just works because the container runs as root with full privileges.

Unprivileged container: the right way

Unprivileged is better for security, but Tailscale needs more setup. First, create the container with the unprivileged option checked. Then edit the config file and add these lines:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
lxc.cap.drop:
lxc.cap.drop: mac_admin mac_override sys_module sys_time

Wait, that last line is wrong. You don’t need to drop capabilities for Tailscale. Actually, you need to add capabilities. The correct lines are:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
lxc.cap.drop:
lxc.cap.drop: net_admin net_raw

No, that’s also wrong. Let me think. Tailscale needs NET_ADMIN and NET_RAW to create the TUN interface and manipulate routes. In an unprivileged container, those capabilities are dropped by default. So you need to add them back:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
lxc.cap.drop:
lxc.cap.drop: net_admin net_raw

Hmm, that’s the same as before. Actually, the syntax to keep capabilities is different. You use lxc.cap.keep:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
lxc.cap.keep: net_admin net_raw

That’s it. Now the container has the necessary capabilities to run Tailscale.

But wait, there’s more. On newer Proxmox versions (7.0+), the cgroup line might not be needed if you use the Proxmox web UI to add the TUN device. In the container’s Resources tab, click Add and choose Device. Then select /dev/net/tun from the dropdown. That automatically adds the correct cgroup and mount entries.

If you’re doing it manually, the config lines above are what you need. After editing the config, restart the container, then install Tailscale inside.

Why this is a pain

Tailscale’s installer script does a lot of things, but it can’t magically grant capabilities that the container doesn’t have. The error messages are vague—something about operation not permitted when creating the TUN interface. That’s the capability issue. The /dev/net/tun device being missing gives you a different error: open /dev/net/tun: no such file or directory.

So if you see either of those, check the config lines. And don’t bother with the old advice about lxc.mount.auto: cgroup:rw—that’s for cgroup v1, and Proxmox 7+ uses cgroup v2.

Honestly, if you’re just running Tailscale for SSH access to a container, consider using a VM instead. It’s heavier but zero config hassle. Or use a privileged container if security isn’t a concern. Unprivileged is the right way, but it’s annoying.

One more thing: if you’re using Tailscale’s MagicDNS, you might need to add lxc.apparmor.profile: unconfined to the config. Some distros have AppArmor profiles that block Tailscale’s DNS. But that’s a separate issue.

For more on LXC containers, check out Proxmox LXC Desktop: Run a Full Linux Desktop in a Container, Not a VM.