# TailGuard

> Self-hosted Docker container that bridges WireGuard-only devices into a Tailscale network, advertising WG subnets to the tailnet with an optional monitoring web UI.

- **Category:** VPN
- **Licence:** MIT
- **Latest version:** v1.104.2
- **Open source:** oss
- **Languages:** Go, HTML, Shell
- **Platforms:** Docker, Docker Compose
- **Tags:** VPN, Udp, Networking, Wireguard, Docker, Bridge, Ipv6, Tailscale, Mesh Vpn, Exit Node, Subnet Routing

## Description

TailGuard is a Docker container that links an existing WireGuard setup to a Tailscale network, aimed at machines whose WireGuard installation is locked down or cannot run Tailscale software. It keeps a permanent Tailscale peer and a WireGuard client in one container, usually on a VPS near the WireGuard endpoint, and relies on plain IP forwarding rather than any protocol translation. You give it a downloaded WireGuard config as wg0.conf, then tune behaviour with environment variables: a destination address for tailnet traffic, extra advertised routes, exit-node selection in client mode, fallback DNS, host-exposure toggles and per-peer isolation on the WireGuard side. Subnets found in AllowedIPs get published to the tailnet automatically; traffic back the other way needs routes added on your WireGuard side. The container joins the tailnet through the login link it prints at startup or via an auth key, and an optional status page shows Tailscale and WireGuard tunnel state once you set a port for it. Run it with the published ghcr.io image through docker run, or build it locally with docker compose; a self-managed control server can be used instead of Tailscale's hosted one.

## Links

- [Homepage](https://github.com/juhovh/tailguard)
- [Docker](ghcr.io/juhovh/tailguard)

---
Source: https://selfhost.directory/project/tailguard