{"slug":"tailscale-on-flyio","title":"Tailscale on Fly.io","tags":["tailscale","setup"],"agent_summary":"Last validated: Dec 4, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale on Fly.io\r\n\r\nLast validated: Dec 4, 2025\r\n\r\n[Fly.io](https://fly.io/) is a popular service to deploy full stack apps and databases all over the world, with Fly handling operations and scaling in each region according to demand. Adding Tailscale to a fly.io application is straightforward, allowing the App on Fly to communicate with other nodes and services in your tailnet.\r\n\r\n## [Step 1: Generate an auth key to authenticate your App on Fly](https://tailscale.com/docs/install/cloud/flydotio\\#step-1-generate-an-auth-key-to-authenticate-your-app-on-fly)\r\n\r\nFirst, we'll [generate an auth key](https://tailscale.com/docs/features/access-control/auth-keys) to allow fly.io to authenticate our app to join our network.\r\n\r\nOpen the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console and select **Generate auth key**. We recommend using a reusable and pre-authorized [ephemeral key](https://tailscale.com/docs/features/ephemeral-nodes) for this purpose, since it will automatically clean up devices after they shut down.\r\n\r\n![Tailscale's auth key generation page](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fephemeral-keys.2d3fc94f.png&w=750&q=75)\r\n\r\nThe **Pre-approved** option will only display in the dialog if [device approval](https://tailscale.com/docs/features/access-control/device-management/device-approval) is enabled in your Tailscale network.\r\n\r\nNext, use `flyctl secrets set TAILSCALE_AUTHKEY=\"tskey-\"` to securely store the auth key for the App on Fly to use.\r\n\r\n## [Step 2: Configure your Dockerfile to install Tailscale](https://tailscale.com/docs/install/cloud/flydotio\\#step-2-configure-your-dockerfile-to-install-tailscale)\r\n\r\nNext, we'll use a [multistage Dockerfile](https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds), where the first stage builds your application, and the second stage pulls application code and Tailscale into the final image to be uploaded to Fly.\r\n\r\nIn your `Dockerfile`:\r\n\r\n```docker\r\nFROM alpine:latest as builder\r\nWORKDIR /app\r\nCOPY . ./\r\n# This is where one could build the application code as well.\r\n\r\n# https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds\r\nFROM alpine:latest\r\nRUN apk update && apk add ca-certificates iptables ip6tables && rm -rf /var/cache/apk/*\r\n\r\n# Copy binary to production image.\r\nCOPY --from=builder /app/start.sh /app/start.sh\r\n\r\n# Copy Tailscale binaries from the tailscale image on Docker Hub.\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscaled /app/tailscaled\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscale /app/tailscale\r\nRUN mkdir -p /var/run/tailscale /var/cache/tailscale /var/lib/tailscale\r\n\r\n# Run on container startup.\r\nCMD [\"/app/start.sh\"]\r\n```\r\n\r\nThe Dockerfile specifies `/app/start.sh` as the initial process to run. This script needs to bring Tailscale up and then start the application binary. This is where we can use the `TAILSCALE_AUTHKEY` variable we defined earlier.\r\n\r\nThen, create a file named `start.sh` at the root of your app:\r\n\r\n```shell\r\n#!/bin/sh\r\n\r\n/app/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock &\r\n/app/tailscale up --auth-key=${TAILSCALE_AUTHKEY} --hostname=fly-app\r\n/app/my-app\r\n```\r\n\r\nThe next time your App on Fly deploys, it will be able to connect to your private Tailscale network.\r\n\r\nIf you are using an Alpine base image and an existing Fly machine, you may need to update the machine to ensure that it has kernel support for nftables. For more information, refer to [Fly community post](https://community.fly.io/t/kernel-nftables-support/17669) and [Tailscale issue #10540](https://github.com/tailscale/tailscale/issues/10540).\r\n\r\n## [Remove ephemeral nodes from a tailnet](https://tailscale.com/docs/install/cloud/flydotio\\#remove-ephemeral-nodes-from-a-tailnet)\r\n\r\nWhen an ephemeral node goes offline, it is automatically removed from your tailnet. You can also control ephemeral node removal using the [`tailscale logout`](https://tailscale.com/docs/reference/tailscale-cli#logout) command to either manually force the removal or incorporate the command into the [`tailscaled`](https://tailscale.com/docs/reference/tailscaled) Tailscale daemon. For more information, refer to [Ephemeral nodes](https://tailscale.com/docs/features/ephemeral-nodes#faq).\r\n","html":"

Tailscale on Fly.io

\n

Last validated: Dec 4, 2025

\n

Fly.io is a popular service to deploy full stack apps and databases all over the world, with Fly handling operations and scaling in each region according to demand. Adding Tailscale to a fly.io application is straightforward, allowing the App on Fly to communicate with other nodes and services in your tailnet.

\n

Step 1: Generate an auth key to authenticate your App on Fly

\n

First, we'll generate an auth key to allow fly.io to authenticate our app to join our network.

\n

Open the Keys page of the admin console and select Generate auth key. We recommend using a reusable and pre-authorized ephemeral key for this purpose, since it will automatically clean up devices after they shut down.

\n

\"Tailscale's

\n

The Pre-approved option will only display in the dialog if device approval is enabled in your Tailscale network.

\n

Next, use flyctl secrets set TAILSCALE_AUTHKEY=\"tskey-<key>\" to securely store the auth key for the App on Fly to use.

\n

Step 2: Configure your Dockerfile to install Tailscale

\n

Next, we'll use a multistage Dockerfile, where the first stage builds your application, and the second stage pulls application code and Tailscale into the final image to be uploaded to Fly.

\n

In your Dockerfile:

\n
FROM alpine:latest as builder\r\nWORKDIR /app\r\nCOPY . ./\r\n# This is where one could build the application code as well.\r\n\r\n# https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds\r\nFROM alpine:latest\r\nRUN apk update && apk add ca-certificates iptables ip6tables && rm -rf /var/cache/apk/*\r\n\r\n# Copy binary to production image.\r\nCOPY --from=builder /app/start.sh /app/start.sh\r\n\r\n# Copy Tailscale binaries from the tailscale image on Docker Hub.\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscaled /app/tailscaled\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscale /app/tailscale\r\nRUN mkdir -p /var/run/tailscale /var/cache/tailscale /var/lib/tailscale\r\n\r\n# Run on container startup.\r\nCMD [\"/app/start.sh\"]\n
\n

The Dockerfile specifies /app/start.sh as the initial process to run. This script needs to bring Tailscale up and then start the application binary. This is where we can use the TAILSCALE_AUTHKEY variable we defined earlier.

\n

Then, create a file named start.sh at the root of your app:

\n
#!/bin/sh\r\n\r\n/app/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock &\r\n/app/tailscale up --auth-key=${TAILSCALE_AUTHKEY} --hostname=fly-app\r\n/app/my-app\n
\n

The next time your App on Fly deploys, it will be able to connect to your private Tailscale network.

\n

If you are using an Alpine base image and an existing Fly machine, you may need to update the machine to ensure that it has kernel support for nftables. For more information, refer to Fly community post and Tailscale issue #10540.

\n

Remove ephemeral nodes from a tailnet

\n

When an ephemeral node goes offline, it is automatically removed from your tailnet. You can also control ephemeral node removal using the tailscale logout command to either manually force the removal or incorporate the command into the tailscaled Tailscale daemon. For more information, refer to Ephemeral nodes.

\n"}