Tailscale vs Cloudflare Tunnel: How to Reach Self-Hosted Docker Services Without a Public IP

Description and use

Tailscale and Cloudflare Tunnel enable access to Docker services without a public IP, using either a private WireGuard mesh or a public HTTPS hostname. Both solutions eliminate the need for static IPs, port forwarding, and manual certificates.

Problem

Accessing self‑hosted Docker services that have no public IP while keeping security and ease of use in mind.

Outcome

Both solutions eliminate the need for port forwarding, static IPs, and manual certificates. Tailscale provides a secure private mesh for internal access, while Cloudflare Tunnel offers a public HTTPS URL for external or client‑only access.

Workflow

• Create a tailnet or Cloudflare account and configure ACLs or Access policies
• Install Tailscale daemon on the Docker host or run the tailscale/tailscale container
• Configure Tailscale: use auth keys for unattended hosts, enable MagicDNS, advertise routes if needed
• Install Cloudflare Tunnel connector (cloudflared) on the host or as a container
• Create a Cloudflare Tunnel, obtain the long‑lived token, and run the connector
• Map a public hostname to the desired Docker service via Cloudflare DNS and ingress rules
• Optionally add Cloudflare Access policies for additional authentication
• Verify connectivity with tailscale status or cloudflared tunnel list

Evidence

Tailscale builds an encrypted WireGuard mesh between your own machines, so your Docker services stay invisible to the public internet and any TCP or UDP port works.

Source

Cloudflare Tunnel runs an outbound‑only connector from your host to Cloudflare's edge, publishing a hostname on the public internet with TLS terminated by Cloudflare.

Source

Neither needs a static IP, a port forward or a manually issued certificate, and running both on the same host is a normal, supported setup.

Source