Install Tailscale on Dokge without sys_mode, possible?

[Ap0ph1s-W4ite]

Hi,

Have been migrating everything to jlmkr but now I am struggling with Tailscale.

Following the Tailscale documentation, I use docker-compose to set a tailscale instance but always get this error Error response from daemon: invalid CapAdd: unknown capability: "CAP_SYS_MODE".
Found this Reddit post with a similar problem with Wireguard. Indeed, if I remove the CAP_ADD SYS_MODE my container just starts but my host doesn't ping any tailscale IP.

docker-compose

version: "3.7"
services:
  tailscale:
    image: tailscale/tailscale:latest
    hostname: docker-truenas
    environment:
      - TS_AUTHKEY=${TSKEY}
      - TS_ROUTES=192.168.1.0/24
      - TS_EXTRA_ARGS=--advertise-exit-node
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=true
    volumes:
      - ${PWD}/tailscale/state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
      - sys_mode # if removed then starts to work but cannot ping anything from the tail network
    restart: unless-stopped

The plan is to install a Syncthing container to upload files to a remote server using Tailscale.
Is this possible to set o Dokge (preference) or another jail? Without sys_mode is it possible to open ports?

[ashe0047]

I also faced this issue when starting Tailscale container, it seems that this sys_module can only be enabled on LXC containers but not jail. Any solution would be appreciated.

[ashe0047]

Yo, found out that you can actually enable the sys_module by passing in --capability=CAP_SYS_MODULE under system_nspawn_user_args= when editing the jail config file.
Your tailscale container should be able to start with the sys_module under cap_add.
Hope that helps!

[Ap0ph1s-W4ite]

Hi, thats great! And it's working?

What I did was create a Jail just for Tailscale.