{"slug":"tailscale-on-aws-lambda","title":"Tailscale on AWS Lambda","tags":["tailscale","setup"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale on AWS Lambda\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nAWS Lambda is a popular method of deploying application using containers, rather than managing servers yourself. However, it can be difficult to use Tailscale on AWS Lambda, since it doesn't provide a /dev/net/tun device that Tailscale needs.\r\n\r\nYou can use Tailscale's [userspace networking mode](https://tailscale.com/docs/concepts/userspace-networking) to connect your AWS Lambda apps to your Tailscale network.\r\n\r\n## [Step 1: Generate an auth key to authenticate your AWS Lambda containers](https://tailscale.com/docs/install/cloud/aws/aws-lambda\\#step-1-generate-an-auth-key-to-authenticate-your-aws-lambda-containers)\r\n\r\nFirst, we'll [generate an auth key](https://tailscale.com/docs/features/access-control/auth-keys) to allow AWS Lambda to authenticate our container to join our network.\r\n\r\nOpen the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console and select **Generate auth key**. We recommend using an [ephemeral key](https://tailscale.com/docs/features/ephemeral-nodes) for this purpose, since it will automatically clean up devices after they shut down.\r\n\r\n![Tailscale's auth key generation page](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fephemeral-keys.de85b7fd.png&w=750&q=75)\r\n\r\nThe **Pre-approved** option will only display in the dialog if [device approval](https://tailscale.com/docs/features/access-control/device-management/device-approval) is enabled in your Tailscale network.\r\n\r\nNext, [go to AWS Lambda's](https://console.aws.amazon.com/) Configuration tab and select the Environment Variables item. From here select Edit, add a new environment variable, and name it `TAILSCALE_AUTHKEY`. Use the `tskey-` string as the Value.\r\n\r\n## [Step 2: Configure your Dockerfile to install Tailscale](https://tailscale.com/docs/install/cloud/aws/aws-lambda\\#step-2-configure-your-dockerfile-to-install-tailscale)\r\n\r\nNext, we'll use a [multistage Dockerfile](https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds), where the first stage builds your application, and the second stage pulls application code and Tailscale into the final image to be uploaded to AWS.\r\n\r\nIn your `Dockerfile`:\r\n\r\n```docker\r\nFROM public.ecr.aws/lambda/provided:al2 as builder\r\nWORKDIR /app\r\nCOPY . ./\r\n# This is where one could build the application code as well.\r\n\r\nFROM public.ecr.aws/lambda/provided:al2\r\n# Copy binary to production image.\r\nCOPY --from=builder /app/bootstrap /var/runtime/bootstrap\r\n\r\n# Copy Tailscale binaries from the tailscale image on Docker Hub.\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscaled /var/runtime/tailscaled\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscale /var/runtime/tailscale\r\nRUN mkdir -p /var/run && ln -s /tmp/tailscale /var/run/tailscale && \\\r\n mkdir -p /var/cache && ln -s /tmp/tailscale /var/cache/tailscale && \\\r\n mkdir -p /var/lib && ln -s /tmp/tailscale /var/lib/tailscale && \\\r\n mkdir -p /var/task && ln -s /tmp/tailscale /var/task/tailscale\r\n\r\n# Run on container startup.\r\nENTRYPOINT [\"/var/runtime/bootstrap\"]\r\n```\r\n\r\nThe Dockerfile specifies `/var/runtime/bootstrap` as the initial process to run. This script needs to bring Tailscale up and then start the application binary. This is where we can use the `TAILSCALE_AUTHKEY` variable we defined earlier.\r\n\r\nThen, create a file named `bootstrap` at the root of your app:\r\n\r\n```shell\r\n#!/bin/sh\r\n\r\nmkdir -p /tmp/tailscale\r\n/var/runtime/tailscaled --tun=userspace-networking --socks5-server=localhost:1055 &\r\n/var/runtime/tailscale up --auth-key=${TAILSCALE_AUTHKEY} --hostname=aws-lambda-app\r\necho Tailscale started\r\nALL_PROXY=socks5://localhost:1055/ /var/runtime/my-app\r\n```\r\n\r\nThe next time your AWS Lambda container deploys, it will be able to connect to your private Tailscale network.\r\n\r\n## [Remove ephemeral nodes from a tailnet](https://tailscale.com/docs/install/cloud/aws/aws-lambda\\#remove-ephemeral-nodes-from-a-tailnet)\r\n\r\nWhen an ephemeral node goes offline, it is automatically removed from your tailnet. You can also control ephemeral node removal using the [`tailscale logout`](https://tailscale.com/docs/reference/tailscale-cli#logout) command to either manually force the removal or incorporate the command into the [`tailscaled`](https://tailscale.com/docs/reference/tailscaled) Tailscale daemon. For more information, refer to [Ephemeral nodes](https://tailscale.com/docs/features/ephemeral-nodes#faq).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Tailscale on AWS Lambda

\n

Last validated: Jan 5, 2026

\n

AWS Lambda is a popular method of deploying application using containers, rather than managing servers yourself. However, it can be difficult to use Tailscale on AWS Lambda, since it doesn't provide a /dev/net/tun device that Tailscale needs.

\n

You can use Tailscale's userspace networking mode to connect your AWS Lambda apps to your Tailscale network.

\n

Step 1: Generate an auth key to authenticate your AWS Lambda containers

\n

First, we'll generate an auth key to allow AWS Lambda to authenticate our container to join our network.

\n

Open the Keys page of the admin console and select Generate auth key. We recommend using an ephemeral key for this purpose, since it will automatically clean up devices after they shut down.

\n

\"Tailscale's

\n

The Pre-approved option will only display in the dialog if device approval is enabled in your Tailscale network.

\n

Next, go to AWS Lambda's Configuration tab and select the Environment Variables item. From here select Edit, add a new environment variable, and name it TAILSCALE_AUTHKEY. Use the tskey-<key> string as the Value.

\n

Step 2: Configure your Dockerfile to install Tailscale

\n

Next, we'll use a multistage Dockerfile, where the first stage builds your application, and the second stage pulls application code and Tailscale into the final image to be uploaded to AWS.

\n

In your Dockerfile:

\n
FROM public.ecr.aws/lambda/provided:al2 as builder\r\nWORKDIR /app\r\nCOPY . ./\r\n# This is where one could build the application code as well.\r\n\r\nFROM public.ecr.aws/lambda/provided:al2\r\n# Copy binary to production image.\r\nCOPY --from=builder /app/bootstrap /var/runtime/bootstrap\r\n\r\n# Copy Tailscale binaries from the tailscale image on Docker Hub.\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscaled /var/runtime/tailscaled\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscale /var/runtime/tailscale\r\nRUN mkdir -p /var/run && ln -s /tmp/tailscale /var/run/tailscale && \\\r\n    mkdir -p /var/cache && ln -s /tmp/tailscale /var/cache/tailscale && \\\r\n    mkdir -p /var/lib && ln -s /tmp/tailscale /var/lib/tailscale && \\\r\n    mkdir -p /var/task && ln -s /tmp/tailscale /var/task/tailscale\r\n\r\n# Run on container startup.\r\nENTRYPOINT [\"/var/runtime/bootstrap\"]\n
\n

The Dockerfile specifies /var/runtime/bootstrap as the initial process to run. This script needs to bring Tailscale up and then start the application binary. This is where we can use the TAILSCALE_AUTHKEY variable we defined earlier.

\n

Then, create a file named bootstrap at the root of your app:

\n
#!/bin/sh\r\n\r\nmkdir -p /tmp/tailscale\r\n/var/runtime/tailscaled --tun=userspace-networking --socks5-server=localhost:1055 &\r\n/var/runtime/tailscale up --auth-key=${TAILSCALE_AUTHKEY} --hostname=aws-lambda-app\r\necho Tailscale started\r\nALL_PROXY=socks5://localhost:1055/ /var/runtime/my-app\n
\n

The next time your AWS Lambda container deploys, it will be able to connect to your private Tailscale network.

\n

Remove ephemeral nodes from a tailnet

\n

When an ephemeral node goes offline, it is automatically removed from your tailnet. You can also control ephemeral node removal using the tailscale logout command to either manually force the removal or incorporate the command into the tailscaled Tailscale daemon. For more information, refer to Ephemeral nodes.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}