Loading today’s stories
Build1 distinct publisher2 min readUpdated
The standard --tun=userspace-networking advice produces a tailnet member you cannot SSH into. The repair is two lines of container config, not a privileged container.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
Rank the failure modes before you rank the fixes. A hung SSH session is loud, and you find it inside an hour [1]. The quiet one is outbound traffic: in userspace mode nothing on the system routes to 100.64.0.0/10, because there is no interface and no route, so every client has to be pointed at the SOCKS5 or HTTP proxy that tailscaled exposes on a local port [4]. Miss that variable in one systemd unit or one cron job and the packets take the normal default route with no error at all [5]. That is the sort of thing that stays wrong for months, and it is a property of the design rather than a mistake in it.
Tailscale SSH is what keeps the design's edges out of view. It genuinely works in userspace mode, which is why plenty of operators never discover the limitation, according to the post [7]. What they have is tailscaled acting as the SSH server, not OpenSSH answering on the container's own port, because tailnet packets terminate in netstack with no path to a kernel-owned socket unless you build one [6][7].
The debugging trail is where the time goes. Forum advice converges on three knobs, and by the post's account two of them are irrelevant to the problem: nesting governs cgroup hierarchy and procfs/sysfs views, and device access is a separate mechanism entirely [10], while AppArmor unconfined is named as the third dead end [11]. So of the three remedies in circulation, two change nothing about TUN and the third changes the container's security model [14]. The working answer sits in the mechanism none of them touch, and the post supplies it as two lines that leave the container unprivileged [2][10].
The test of success is also worth restating, because the admin console is not it. What you are buying is a kernel network interface that `ip addr` can see, a real address in the CGNAT range, and a direct WireGuard path rather than reachability borrowed from something else [13]. A green dot and a healthy `tailscale status` were available all along [1].
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
Two lines in the LXC config file fix the problem, and the container stays unprivileged.
With tailscale up --tun=userspace-networking, the node appears in the tailnet and tailscale status looks healthy, but SSH into that container from a laptop hangs until TCP gives up.
In userspace mode tailscaled runs a userspace TCP/IP stack (gVisor's netstack) inside its own process and never opens /dev/net/tun.
In userspace mode tailscaled exposes SOCKS5 and HTTP proxies on a local port; nothing on the system routes to 100.64.0.0/10 automatically because there is no interface and no route, so every client has to be told about the proxy (for example ALL_PROXY=socks5://localhost:1055/).
Missing the proxy environment variable in a systemd unit, a cron job or a nested container makes traffic silently take the normal default route instead, with no error; the author calls this the worst failure mode a network can have.
sshd binds 0.0.0.0:22 on the container's LAN interface, and packets arriving over the tailnet terminate inside tailscaled's netstack with no path to a socket the kernel owns unless built explicitly with tailscale serve or by switching to Tailscale SSH.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed first-hand mechanism, single unverified source
The account is internally coherent and unusually specific about mechanism — gVisor netstack in the tailscaled process, absence of any route to 100.64.0.0/10, the lxc-container-default-cgns profile's actual restrictions, the three device preconditions — and it names reproducible commands (lsmod/modprobe tun, ls -l /dev/net/tun, ALL_PROXY curl). Against that: one publisher, one author, no versions, no upstream documentation or issue links, and the supplied text is truncated before the config snippet that the headline claim rests on.
No adoption data in cluster
The cluster contains no release, deployment, benchmark, pricing, licensing or usage-volume evidence. The author's remarks that 'every guide' recommends userspace mode and that forums recommend privileged containers are impressions about community advice, not measurable adoption of the technique described, so no adoption value is asserted.
'Two lines' understates the host-side and cluster-wide work
Claims are modest and mechanism-grounded rather than promotional, so the gap is small. It is positive rather than zero because the title and dek compress the fix to 'two lines of container config' while the body itself adds host prerequisites — loading and persisting the tun module, repeating that on every cluster node, and ordering the module load before the bind mount or the container refuses to start. The severity framing ('worst failure mode a network can have', 'exactly backwards') is also rhetorically stronger than the supporting single-operator evidence.
Self-published tutorial with internal cross-promotion, no vendor stake shown
Incentive pressure is mild and structural rather than commercial: this is a personal dev.to post whose format rewards a clean 'everyone else is wrong, here is the narrow fix' narrative, and it links to the author's own prior pieces (a Tailscale subnet-router post and a runc sysctl post), which favours framing the topic as a ladder of further posts. No vendor sponsorship, affiliate relationship or product being sold is disclosed or apparent, and the piece concedes that userspace mode is a reasonable documented tradeoff for some workloads.
Plausible and specific, but uncorroborated and version-free
Confidence is moderate: the technical reasoning is consistent with how userspace networking and LXC device access are generally structured, and the claims are specific enough to be checked. It is held below high because the entire cluster is one self-published article, adoption is unmeasured, no software versions anchor the UDP and AppArmor assertions, and the supplied text stops before the configuration lines that the central claim depends on.
build
qm start said nothing, the UI said stopped, and only host dmesg named the passthrough failure1 distinct publisher
build
A 28-host Debian 12 cutover, and the 02:13 failure Ansible could not have prevented1 distinct publisher
build
Debian 13 cleans /tmp, and Plex's EAC3 transcoding dies ten days later1 distinct publisher
build
Two hardware tokens, one wrong guess: why SSH keeps asking for your PIN twice1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 21, 2026