KoloMl
3886d956cc
Tailscale's exit-node "route all traffic" mode captures Docker's forwarded container traffic into its tunnel and drops it as an unrecognized flow, causing every outbound request from inside a container to hang until timeout. This installs a systemd timer that keeps an ip rule in place routing Docker's bridge subnet around Tailscale's catch-all route instead. Co-Authored-By: Claude Code <noreply@anthropic.com>
23 lines
904 B
SYSTEMD
23 lines
904 B
SYSTEMD
# Written by an LLM (Claude Code) — review before trusting on a machine
|
|
# other than the one this was diagnosed on. See README.md.
|
|
#
|
|
# Runs docker-tailscale-route.service shortly after boot and then every
|
|
# 15s afterward, so the ip rule that exempts Docker's bridge traffic from
|
|
# Tailscale's exit-node catch-all route gets reinstated quickly after a
|
|
# reboot or a Tailscale reconnect (both can wipe/recreate Tailscale's own
|
|
# ip rules and leave ours missing in the process). Polling is used
|
|
# instead of a network-event hook because NetworkManager doesn't manage
|
|
# the tailscale0 interface and never fires dispatcher/udev events we
|
|
# could reliably hook into for it (confirmed by testing).
|
|
|
|
[Unit]
|
|
Description=Periodically ensure Docker bridge traffic bypasses Tailscale's exit-node route
|
|
|
|
[Timer]
|
|
OnBootSec=5s
|
|
OnUnitActiveSec=15s
|
|
Unit=docker-tailscale-route.service
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|