I’m currently working remotely from my camper van, traveling around Europe while staying connected to my work.
One thing I really need is reliable access to my home network. I want to SSH into my servers, access my homelab services, and manage my infrastructure—all from wherever I’m parked.
Tailscale makes this dead simple. It creates a secure mesh VPN that just works, no matter what weird network you’re connected to.
Why Podman Quadlet?
On Fedora Atomic systems (like Silverblue, Kinoite, or Sway), you can’t easily install packages the traditional way. The base system is immutable.
You have a few options:
- Layer packages with
rpm-ostree install(reboots required) - Use Flatpak for GUI apps
- Run services in containers
I run everything in containers if I can help it.
It keeps the base system clean, and Quadlet makes it feel like a native systemd service.
The quadlet file will be committed to my dotfiles, so I’ll have it version controlled and easily reproduced on any new system.
Prerequisites
Before starting, you’ll need:
- Fedora Atomic (Silverblue, Kinoite, Sway, etc.)
- Podman (included by default)
- A Tailscale account at login.tailscale.com
Setup
1. Create the Quadlet directory
mkdir -p ~/.config/containers/systemd
2. Create the container file
Create ~/.config/containers/systemd/tailscale.container:
[Unit]
Description=Tailscale VPN
After=network-online.target
Wants=network-online.target
[Container]
Image=docker.io/tailscale/tailscale:stable
ContainerName=tailscale
# Persist state across reboots
Volume=tailscale-state:/var/lib/tailscale:Z
# Configuration
Environment=TS_STATE_DIR=/var/lib/tailscale
Environment=TS_HOSTNAME=fedora-sway
Environment=TS_AUTH_ONCE=true
Environment=TS_ACCEPT_DNS=true
Environment=TS_USERSPACE=true
[Service]
Restart=always
TimeoutStartSec=300
[Install]
WantedBy=default.target
3. Reload systemd and start
# Reload to pick up the new container file
systemctl --user daemon-reload
# Start the service
systemctl --user start tailscale
# Verify it's running
systemctl --user status tailscale
4. Authenticate
podman exec tailscale tailscale login
This outputs a URL. Open it in your browser to authenticate with your Tailscale account.
Verify the connection:
podman exec tailscale tailscale status
Configuration Options
Environment Variables
| Variable | Description | Default |
|---|---|---|
TS_HOSTNAME | Device name shown in Tailscale admin | Container ID |
TS_AUTH_ONCE | Only authenticate if not already logged in | false |
TS_ACCEPT_DNS | Use MagicDNS from Tailscale | false |
TS_USERSPACE | Use userspace networking (required for rootless) | true |
TS_AUTHKEY | Auth key for unattended setup | None |
TS_ROUTES | Subnet routes to advertise | None |
Unattended Authentication
For fully automated setup (useful for reinstalls), generate an auth key at admin.tailscale.com/settings/keys and add:
Environment=TS_AUTHKEY=tskey-auth-xxxxxxxxxxxxx
Append ?ephemeral=true to the key if you want the node to auto-remove when offline.
Using an OAuth Client (Recommended for Automation)
For infrastructure-as-code setups, create an OAuth client at admin.tailscale.com/settings/oauth:
Environment=TS_AUTHKEY=tskey-client-xxxxxxxxxxxxx
Environment=TS_EXTRA_ARGS=--advertise-tags=tag:container
Note: OAuth clients require advertising at least one tag.
Shell Aliases
Add to your ~/.bashrc or ~/.zshrc:
# Tailscale shortcuts
alias ts='podman exec tailscale tailscale'
alias ts-status='podman exec tailscale tailscale status'
alias ts-ip='podman exec tailscale tailscale ip'
alias ts-exit='podman exec tailscale tailscale set --exit-node'
alias ts-exit-off='podman exec tailscale tailscale set --exit-node='
Common Commands
# Check connection status
podman exec tailscale tailscale status
# Get your Tailscale IP addresses
podman exec tailscale tailscale ip
# Use another device as exit node
podman exec tailscale tailscale set --exit-node=<device-name>
# Stop using exit node
podman exec tailscale tailscale set --exit-node=
# Ping another device on your tailnet
podman exec tailscale tailscale ping <device-name>
# View current settings
podman exec tailscale tailscale debug prefs
Service Management
# Check status
systemctl --user status tailscale
# View logs
journalctl --user -u tailscale -f
# Restart
systemctl --user restart tailscale
# Stop
systemctl --user stop tailscale
# Start on boot (already configured via WantedBy)
# Quadlet handles this automatically
Updating
Pull the latest image and restart:
podman pull docker.io/tailscale/tailscale:stable
systemctl --user restart tailscale
Or pin a specific version in your container file:
Image=docker.io/tailscale/tailscale:v1.92.5
Dotfiles Integration
This is where things get nice. Add the container file to your dotfiles:
dotfiles/
└── .config/
└── containers/
└── systemd/
└── tailscale.container
Your stow or symlink setup will place it in ~/.config/containers/systemd/.
After deploying dotfiles on a fresh system, you just need three commands:
systemctl --user daemon-reload
systemctl --user start tailscale
podman exec tailscale tailscale login
And you’re back on your tailnet.
Troubleshooting
Container won’t start
Check the logs:
journalctl --user -u tailscale --no-pager -n 50
Permission denied errors
Ensure TS_USERSPACE=true is set. Rootless Podman cannot access /dev/net/tun for kernel networking.
DNS not working
Verify TS_ACCEPT_DNS=true is set. Note that container DNS changes may not affect the host system directly with userspace networking.
State lost after reboot
Ensure the volume mount is correct:
podman volume inspect tailscale-state
Re-authentication required
Set TS_AUTH_ONCE=true and ensure the state volume persists. If using an auth key, it may have expired.
Limitations of Userspace Networking
Running in userspace mode means:
- Slightly higher CPU usage for network traffic
- Cannot act as a subnet router for the host
- Cannot use Tailscale as an exit node for other devices
- Host applications don’t automatically route through Tailscale
For exit node or subnet router functionality, you’ll need to install Tailscale directly on the host via rpm-ostree install tailscale or use a privileged system container.
What I Use This For
From my camper van, I can now:
- SSH into my homelab servers
- Access internal services through my tailnet
- Use my home network as an exit node when I need a stable IP
- Keep everything connected even on sketchy campsite WiFi
It just works. That’s the magic of Tailscale.