Tailscale vs Cloudflare Tunnel: How to Reach Self-Hosted Docker Services Without a Public IP

说明与用途

Tailscale 和 Cloudflare Tunnel 通过私有 WireGuard 网络或公共 HTTPS 主机名，允许在没有公网 IP 的情况下访问 Docker 服务。两种方案都消除了静态 IP、端口转发和手动证书的需求。

问题

Accessing self‑hosted Docker services that have no public IP while keeping security and ease of use in mind.

结果

Both solutions eliminate the need for port forwarding, static IPs, and manual certificates. Tailscale provides a secure private mesh for internal access, while Cloudflare Tunnel offers a public HTTPS URL for external or client‑only access.

工作流

• Create a tailnet or Cloudflare account and configure ACLs or Access policies
• Install Tailscale daemon on the Docker host or run the tailscale/tailscale container
• Configure Tailscale: use auth keys for unattended hosts, enable MagicDNS, advertise routes if needed
• Install Cloudflare Tunnel connector (cloudflared) on the host or as a container
• Create a Cloudflare Tunnel, obtain the long‑lived token, and run the connector
• Map a public hostname to the desired Docker service via Cloudflare DNS and ingress rules
• Optionally add Cloudflare Access policies for additional authentication
• Verify connectivity with tailscale status or cloudflared tunnel list

证据

Tailscale builds an encrypted WireGuard mesh between your own machines, so your Docker services stay invisible to the public internet and any TCP or UDP port works.

来源

Cloudflare Tunnel runs an outbound‑only connector from your host to Cloudflare's edge, publishing a hostname on the public internet with TLS terminated by Cloudflare.

来源

Neither needs a static IP, a port forward or a manually issued certificate, and running both on the same host is a normal, supported setup.

来源