KoloMl
3886d956cc
Tailscale's exit-node "route all traffic" mode captures Docker's forwarded container traffic into its tunnel and drops it as an unrecognized flow, causing every outbound request from inside a container to hang until timeout. This installs a systemd timer that keeps an ip rule in place routing Docker's bridge subnet around Tailscale's catch-all route instead. Co-Authored-By: Claude Code <noreply@anthropic.com>
64 lines
2.1 KiB
Bash
Executable File
64 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# Written by an LLM (Claude Code) — review before trusting on a machine
|
|
# other than the one this was diagnosed on. See README.md.
|
|
#
|
|
# Installs the docker-tailscale-route fix: a systemd timer that keeps an
|
|
# ip rule in place routing Docker's bridge traffic around Tailscale's
|
|
# exit-node catch-all route. See docker-tailscale-route.sh for the full
|
|
# explanation of the underlying problem.
|
|
#
|
|
# Usage:
|
|
# sudo ./install.sh [--subnet CIDR] [--priority N] [--table NAME]
|
|
#
|
|
# The optional flags only need to be passed if Docker's default address
|
|
# pool doesn't apply on this machine (see the comment in
|
|
# docker-tailscale-route.sh); they're written to
|
|
# /etc/default/docker-tailscale-route and sourced by the script at
|
|
# runtime.
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "Must be run as root (sudo ./install.sh)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
SUBNET=""
|
|
PRIORITY=""
|
|
TABLE=""
|
|
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--subnet) SUBNET="$2"; shift 2 ;;
|
|
--priority) PRIORITY="$2"; shift 2 ;;
|
|
--table) TABLE="$2"; shift 2 ;;
|
|
*) echo "Unknown argument: $1" >&2; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
install -o root -g root -m 0755 "$SCRIPT_DIR/docker-tailscale-route.sh" /usr/local/sbin/docker-tailscale-route.sh
|
|
install -o root -g root -m 0644 "$SCRIPT_DIR/docker-tailscale-route.service" /etc/systemd/system/docker-tailscale-route.service
|
|
install -o root -g root -m 0644 "$SCRIPT_DIR/docker-tailscale-route.timer" /etc/systemd/system/docker-tailscale-route.timer
|
|
|
|
if [ -n "$SUBNET" ] || [ -n "$PRIORITY" ] || [ -n "$TABLE" ]; then
|
|
{
|
|
[ -n "$SUBNET" ] && echo "DOCKER_SUBNET=\"$SUBNET\""
|
|
[ -n "$PRIORITY" ] && echo "RULE_PRIORITY=\"$PRIORITY\""
|
|
[ -n "$TABLE" ] && echo "TARGET_TABLE=\"$TABLE\""
|
|
} > /etc/default/docker-tailscale-route
|
|
chown root:root /etc/default/docker-tailscale-route
|
|
chmod 0644 /etc/default/docker-tailscale-route
|
|
fi
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now docker-tailscale-route.timer
|
|
|
|
echo "Installed. Current status:"
|
|
systemctl status docker-tailscale-route.timer --no-pager
|
|
echo
|
|
echo "ip rule list:"
|
|
ip rule list
|