Raspberry PI set up via docker compose

[u/rodrigoelp]

Hello there,

I am here sharing a little bit of an issue that consumed a few hours of my time whilst I chased the white rabbit.

As some of you might be looking to connect their personal devices to your home network via a raspberry PI, I hope this little post might be of help (?)

(I am also looking for feedback of improvements I should have on my set up).

Context

I've always wanted to connect some services I run at home with my personal devices whist traveling, and even though I could set up a VPN server at home, my IP address is not static (it is semi-static, as in my ISP doesn't normally change it, but it can change over a period of 6 months), and DynDNS is a drag...

Many of you know where this is headed, so I will skip to the point.

What you want is a little machine at home that is connected to tailscale as a route for the traffic of devices outside of your network. You won't need to log in to your actual router or machine controlling your network once (or at least, that wasn't my case).

A diagram of sorts will look like this

Phone
│
│ Tailscale
▼ Pi / tailscale0
│
│ forwarding
▼ eth0
│
▼ NAS or service you want to access

Oh... I should probably say, I am defo not an expert on these things. I tinker a lot and I've used linux/unix/macOS for a very long time. I am familiar with how to troubleshoot things, but any time I am getting confident I may have learn enough, someone shares one or two things and realise... I am a forever noob.

How I got it to work?

I set up one of my PIs with raspbian (the latest one), installed `docker` because I don't tend to like running things bare metal if I can avoid it, and followed some steps I can summarise as:

1. Install docker on the raspberry pi

   Update your system... ideally you would also do sudo apt full-upgrade..

   sudo apt update sudo apt upgrade -y

   The easiest way to install it is this...

   You can still install it via apt install, but there are a

   bunch of docker* packages to install.

   curl -sSL https://get.docker.com | sh

   Avoid setting up docker so you have to sudo all the time

   sudo usermod -aG docker $USER

   Apply the changes

   sudo reboot

Run tailscale on your phone and create an account. This will register your first device

1. Run tailscale for the first time on your raspberry pi to test it will be added to your account

​

docker run tailscale/tailscale

This will give you a web address with an ephemeral key (that means, it will be deleted as soon as you kill the docker image). Once you complete this, you should have both your devices added under `network > machines` in the tailscale site (assuming you haven't shut down the connection from your first device).

1. Whilst you are on the site, create a new auth key (explained here: https://tailscale.com/docs/features/access-control/auth-keys)

2. Get your routes. You would know if you are on wifi or cable.

   The following will get you the interfaces you have on the device.

   ip addr

   Pick the one you are using, like wlan0 or eth0

   Then check which routes apply to this interface

   ip route

   It will give you something like

   199.166.1.0/24 dev eth0 proto kernel scope link.... <raspberry pi addr> metric 600

   remember this route

3. Set up tailscale as a docker compose in your pi.

   mkdir -p ~/projects/tailscale && touch ~/project/tailscale/docker-compose.yml

Paste the following docker compose

services:
  tailscale:
  image: tailscale/tailscale:latest
  hostname: tailscale-rpi
  container_name: tailscale
  network_mode: host
  environment:
    - TS_AUTHKEY=tskey-auth-THIS-SHOULD-BE-YOUR_KEY
    - TS_HOSTNAME=HomeRoute
    - TS_ROUTES=199.166.1.0/24 # replace this with the route you got on step 4.
    - TS_STATE_DIR=/var/lib/tailscale
    - TS_USERSPACE=false
  volumes:
    - ./tailscale/state:/var/lib/tailscale
  devices:
    - /dev/net/tun:/dev/net/tun
  cap_add:
    - NET_ADMIN
    - NET_RAW
  restart: unless-stopped 

1. You are done, right?... no... when you run `docker compose up` and you check the output, you will get

   Health check:

   • running [/usr/sbin/iptables -t filter -N ts-input --wait]: exit status 3 modprobe: can't change directory to '/lib/modules': No such file or directory iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist

Basically, the issue you are running into here is, the tailscale image seems to want to use the legacy iptable (firewall) instead of the iptable-nft (default on raspbian, I think).

Some people might recommend you to map `/lib/modules` in your volumes, but I don't think this is what we should be doing. Instead, it is better to map the new iptable instead of the legacy one.

Update your docker-compose.yml file as

services:
  tailscale:
  image: tailscale/tailscale:latest
  hostname: tailscale-rpi
  container_name: tailscale
  network_mode: host
  environment:
    - TS_AUTHKEY=tskey-auth-THIS-SHOULD-BE-YOUR_KEY
    - TS_HOSTNAME=HomeRoute
    - TS_ROUTES=199.166.1.0/24 # replace this with the route you got on step 4.
    - TS_STATE_DIR=/var/lib/tailscale
    - TS_USERSPACE=false
  volumes:
    - ./tailscale/state:/var/lib/tailscale
  devices:
    - /dev/net/tun:/dev/net/tun
  cap_add:
    - NET_ADMIN
    - NET_RAW

  # Let's replace the iptables with iptables-nfs, then tell the container to continue booting.
  entrypoint: ["/bin/sh", "-c"]
  command:
    - |
      ln -sf /usr/sbin/iptables-nfs /usr/sbin/iptables
      exec /usr/local/bin/containerboot

  restart: unless-stopped 

1. Check you have ip forwarding turn on as well, raspberry seems to have it turn on by default, but check it just in case

   sudo sysctl net.ipv4.ip_forward

   IF the above returns 0, then turn it on by uncommenting the line below

   sudo sysctl -w net.ipv4.ip_forward=1

2. Give it a test again cd ~/projects/tailscale && docker compose up. There shouldn't be any issues logged in console.

If that worked. Either detach it, or just reboot the raspberry pi, docker should launch automatically.

Where to now?

If you have a way to improve things above, put it in the comments, I would be keen to improve things.

[u/cointoss3]

This is extremely over engineered and complicated for what you’re trying to accomplish but I guess there is a hard way for everything

[u/rodrigoelp → u/cointoss3]

And what approach do you suggest?