{"slug":"tailscale-in-lxc-containers","title":"Tailscale in LXC containers","tags":["tailscale"],"agent_summary":"Last validated: Jan 9, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale in LXC containers\r\n\r\nLast validated: Jan 9, 2026\r\n\r\nUnprivileged LXC containers do not have access to the networking resource needed for Tailscale to work. This topic explains how to give it access.\r\n\r\nAmong many other uses, LXC containers are often found in Proxmox virtualization environments.\r\n\r\nHow to install Tailscale in an LXC on Proxmox - YouTube\r\n\r\nTap to unmute\r\n\r\n[How to install Tailscale in an LXC on Proxmox](https://www.youtube.com/watch?v=JC63OGSzTQI) [Tailscale](https://www.youtube.com/channel/UCcdv38QxPjSMqbt5ffLhJLA)\r\n\r\nTailscale68.5K subscribers\r\n\r\n## [Instructions](https://tailscale.com/docs/features/containers/lxc/lxc-unprivileged\\#instructions)\r\n\r\nAn LXC is a lightweight way to run a virtualized Linux system. An unprivileged LXC is one where the root user (`uid 0`) within the container is mapped to an unprivileged user in the host system, making it possible to run an LXC more securely.\r\n\r\nTailscale encapsulates its frames in UDP packets and therefore doesn't require kernel modules or other privileged operations to form tunnel connections. However, it does need access to a `/dev/net/tun` (TUN) device which unprivileged containers usually do not provide.\r\n\r\nTo bring up Tailscale in an unprivileged container, you can enable access to the `/dev/net/tun` device through the user interface:\r\n\r\n1. Create your LXC container.\r\n\r\n2. Go to the **Resources** tab of the container.\r\n\r\n3. Select **Add**. Then select **Device Passthrough**.\r\n![User interface for enabling Device Passthrough.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fproxmox-device-passthrough.156f9873.png&w=1080&q=75)\r\n4. On the **Add Device** prompt, enter `dev/net/tun` in the **Device Path** field and select **Add**.\r\n![User interface for adding a device.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fproxmox-add-device.94fad82d.png&w=1080&q=75)\r\n5. If the container is running, shut it down and start it up again.\r\n\r\n6. Once `/dev/net/tun` is available, the Tailscale Linux package can be installed in the system running within the LXC.\r\n\r\n\r\nAlternatively, if you don't want to grant `/dev/net/tun` access, you can use [userspace networking mode](https://tailscale.com/docs/concepts/userspace-networking) which avoids the need for any administrative access at all.\r\n\r\n## [FAQ](https://tailscale.com/docs/features/containers/lxc/lxc-unprivileged\\#faq)\r\n\r\n### [Proxmox Container Tools](https://tailscale.com/docs/features/containers/lxc/lxc-unprivileged\\#proxmox-container-tools)\r\n\r\nAn alternative method for adding the TUN device and additional permissions to the LXC container is with the [`pct set`](https://pve.proxmox.com/pve-docs/chapter-pct.html) command.\r\n\r\n```shell\r\npct set CTID --dev0 /dev/net/tun\r\npct set CTID --features keyctl=1,nesting=1\r\n```\r\n\r\n### [Providing access for Proxmox 7](https://tailscale.com/docs/features/containers/lxc/lxc-unprivileged\\#providing-access-for-proxmox-7)\r\n\r\nIn versions without user interface support, you can enable access to the `/dev/net/tun` device in the configuration for the LXC. For example, using Proxmox 7.0 to host as unprivileged LXC with ID 112, the following lines would be added to `/etc/pve/lxc/112.conf`:\r\n\r\n```shell\r\nlxc.cgroup2.devices.allow: c 10:200 rwm\r\nlxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file\r\n```\r\n\r\nIf the LXC is already running it will need to be shut down and started again for this change to take effect.\r\n\r\n### [Providing access for Proxmox 6 and earlier](https://tailscale.com/docs/features/containers/lxc/lxc-unprivileged\\#providing-access-for-proxmox-6-and-earlier)\r\n\r\nUse the `cgroup` environment (instead of the Proxmox 7 `cgroup2` environment):\r\n\r\n```shell\r\nlxc.cgroup.devices.allow: c 10:200 rwm\r\nlxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file\r\n```\r\n\r\nIf you don't want to enable `/dev/net/tun` access, remove the `lxc.mount.entry:` line.\r\n\r\n### [CentOS 7 and Ubuntu 16.x still have no /dev/net/tun in Proxmox 7.0](https://tailscale.com/docs/features/containers/lxc/lxc-unprivileged\\#centos-7-and-ubuntu-16x-still-have-no-devnettun-in-proxmox-70)\r\n\r\nProxmox has a [guide for containers with a systemd too old to understand cgroup2](https://pve.proxmox.com/wiki/Upgrade_from_6.x_to_7.0#Old_Container_and_CGroupv2).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Tailscale in LXC containers

\n

Last validated: Jan 9, 2026

\n

Unprivileged LXC containers do not have access to the networking resource needed for Tailscale to work. This topic explains how to give it access.

\n

Among many other uses, LXC containers are often found in Proxmox virtualization environments.

\n

How to install Tailscale in an LXC on Proxmox - YouTube

\n

Tap to unmute

\n

How to install Tailscale in an LXC on Proxmox Tailscale

\n

Tailscale68.5K subscribers

\n

Instructions

\n

An LXC is a lightweight way to run a virtualized Linux system. An unprivileged LXC is one where the root user (uid 0) within the container is mapped to an unprivileged user in the host system, making it possible to run an LXC more securely.

\n

Tailscale encapsulates its frames in UDP packets and therefore doesn't require kernel modules or other privileged operations to form tunnel connections. However, it does need access to a /dev/net/tun (TUN) device which unprivileged containers usually do not provide.

\n

To bring up Tailscale in an unprivileged container, you can enable access to the /dev/net/tun device through the user interface:

\n
    \n
  1. \n

    Create your LXC container.

    \n
    2. \n
  2. \n

    Go to the Resources tab of the container.

    \n
    3. \n
  3. \n

    Select Add. Then select Device Passthrough.\r\n\"User

    \n
    4. \n
  4. \n

    On the Add Device prompt, enter dev/net/tun in the Device Path field and select Add.\r\n\"User

    \n
    5. \n
  5. \n

    If the container is running, shut it down and start it up again.

    \n
    6. \n
  6. \n

    Once /dev/net/tun is available, the Tailscale Linux package can be installed in the system running within the LXC.

    \n
    7. \n
\n

Alternatively, if you don't want to grant /dev/net/tun access, you can use userspace networking mode which avoids the need for any administrative access at all.

\n

FAQ

\n

Proxmox Container Tools

\n

An alternative method for adding the TUN device and additional permissions to the LXC container is with the pct set command.

\n
pct set CTID --dev0 /dev/net/tun\r\npct set CTID --features keyctl=1,nesting=1\n
\n

Providing access for Proxmox 7

\n

In versions without user interface support, you can enable access to the /dev/net/tun device in the configuration for the LXC. For example, using Proxmox 7.0 to host as unprivileged LXC with ID 112, the following lines would be added to /etc/pve/lxc/112.conf:

\n
lxc.cgroup2.devices.allow: c 10:200 rwm\r\nlxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file\n
\n

If the LXC is already running it will need to be shut down and started again for this change to take effect.

\n

Providing access for Proxmox 6 and earlier

\n

Use the cgroup environment (instead of the Proxmox 7 cgroup2 environment):

\n
lxc.cgroup.devices.allow: c 10:200 rwm\r\nlxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file\n
\n

If you don't want to enable /dev/net/tun access, remove the lxc.mount.entry: line.

\n

CentOS 7 and Ubuntu 16.x still have no /dev/net/tun in Proxmox 7.0

\n

Proxmox has a guide for containers with a systemd too old to understand cgroup2.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}