What is TailGuard?

TailGuard is a Docker container that links an existing WireGuard setup to a Tailscale network, aimed at machines whose WireGuard installation is locked down or cannot run Tailscale software. It keeps a permanent Tailscale peer and a WireGuard client in one container, usually on a VPS near the WireGuard endpoint, and relies on plain IP forwarding rather than any protocol translation. You give it a downloaded WireGuard config as wg0.conf, then tune behaviour with environment variables: a destination address for tailnet traffic, extra advertised routes, exit-node selection in client mode, fallback DNS, host-exposure toggles and per-peer isolation on the WireGuard side. Subnets found in AllowedIPs get published to the tailnet automatically; traffic back the other way needs routes added on your WireGuard side. The container joins the tailnet through the login link it prints at startup or via an auth key, and an optional status page shows Tailscale and WireGuard tunnel state once you set a port for it. Run it with the published ghcr.io image through docker run, or build it locally with docker compose; a self-managed control server can be used instead of Tailscale's hosted one.

Should you self-host TailGuard?

TailGuard scores 48/100 on selfhost.directory (how scoring works) and ranks #37 of 56 in VPN. It has 611 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v1.104.2, came out on 21 October 2026. New versions land roughly every 2 weeks.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Shell.

Its closest alternative on selfhost.directory is Tailscale (84/100, 38 215 stars). It scores higher overall, so compare the two before you pick. See TailGuard vs Tailscale side by side.