{"slug":"tailscale-on-koyeb","title":"Tailscale on Koyeb","tags":["tailscale","setup"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Tailscale on Koyeb\r\n\r\nLast validated: Jan 5, 2026\r\n\r\n[Koyeb](https://www.koyeb.com/) is a serverless platform for seamlessly deploying AI applications and databases on high-performance infrastructure, including CPUs, GPUs, and Accelerators around the world.\r\nYou can add Tailscale to a Koyeb application to let your Koyeb Services communicate with other devices and services in your tailnet.\r\n\r\n## [Step 1: Generate an auth key to authenticate your Service on Koyeb](https://tailscale.com/docs/install/cloud/koyeb\\#step-1-generate-an-auth-key-to-authenticate-your-service-on-koyeb)\r\n\r\nStart by [generating an auth key](https://tailscale.com/docs/features/access-control/auth-keys) to let your Koyeb service join your tailnet.\r\n\r\nOpen the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console and select **Generate auth key**. It's best practice to use a reusable and pre-authorized [ephemeral key](https://tailscale.com/docs/features/ephemeral-nodes) for this purpose because it automatically cleans up devices after they shut down.\r\n\r\n![Tailscale's auth key generation page](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fephemeral-keys.2d3fc94f.png&w=750&q=75)\r\n\r\nThe **Pre-approved** option will only display in the dialog if [device approval](https://tailscale.com/docs/features/access-control/device-management/device-approval) is enabled in your Tailscale network.\r\n\r\nNext, open a terminal and use the following command to create a [Koyeb Secret](https://www.koyeb.com/docs/reference/secrets) to securely store the auth key on Koyeb.\r\n\r\n```shell\r\nkoyeb secrets create TAILSCALE_AUTHKEY -v \"tskey-\"\r\n```\r\n\r\nPass this Secret using an environment variable to your Koyeb Service to authenticate your application and join your tailnet.\r\n\r\n## [Step 2: Configure your Dockerfile to install Tailscale](https://tailscale.com/docs/install/cloud/koyeb\\#step-2-configure-your-dockerfile-to-install-tailscale)\r\n\r\nNext, build a [multistage Dockerfile](https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds) with two stages:\r\n\r\n- The first stage compiles and builds your application code.\r\n- The second stage pulls your application code and Tailscale into a final image that you can deploy to Koyeb.\r\n\r\nIn your `Dockerfile`:\r\n\r\n```docker\r\nFROM alpine:latest as builder\r\nWORKDIR /app\r\nCOPY . ./\r\n# This is where you build the application code as well.\r\n\r\n# https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds\r\nFROM alpine:latest\r\nRUN apk update && apk add ca-certificates iptables ip6tables && rm -rf /var/cache/apk/*\r\n\r\n# Copy binary to production image.\r\nCOPY --from=builder /app/start.sh /app/start.sh\r\n\r\n# Copy Tailscale binaries from the tailscale image on Docker Hub.\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscaled /app/tailscaled\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscale /app/tailscale\r\nRUN mkdir -p /var/run/tailscale /var/cache/tailscale /var/lib/tailscale\r\n\r\n# Run on container startup.\r\nCMD [\"/app/start.sh\"]\r\n```\r\n\r\nThe Dockerfile specifies the `/app/start.sh` script as the initial process to run. This script starts Tailscale, then runs the application binary. This is where you use the `TAILSCALE_AUTHKEY` variable you defined when you generated an auth key.\r\n\r\nCreate a new file named `start.sh` in the root directory of your application and add the following content to the file to start Tailscale and launch your app:\r\n\r\n```shell\r\n#!/bin/sh\r\n# Start Tailscale\r\n/app/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock &\r\n/app/tailscale up --ssh --auth-key=${TAILSCALE_AUTHKEY} --hostname=tailscale-on-koyeb\r\n\r\n# Start your app\r\n/app/my-app\r\n```\r\n\r\nYou pass the `--ssh` flag to `/app/tailscale up` to authorize SSH connections to the node. This will let you ensure everything is working as expected and let you connect to the node using SSH from your tailnet. Refer to [Tailscale SSH documentation](https://tailscale.com/docs/features/tailscale-ssh) for more information.\r\n\r\nSave the file. You're ready to deploy.\r\n\r\n## [Step 3: Deploy your app to Koyeb](https://tailscale.com/docs/install/cloud/koyeb\\#step-3-deploy-your-app-to-koyeb)\r\n\r\nTo deploy the application on Koyeb, run the following command from your application's root directory. This command creates and deploys a new Koyeb service that connects to your tailnet:\r\n\r\n```markup\r\nkoyeb deploy . myapp/main --instance-type small --region was --type worker --archive-builder docker --env TAILSCALE_AUTHKEY=@TAILSCALE_AUTHKEY --privileged\r\n```\r\n\r\nRun the following command to use SSH to confirm you can connect to the service:\r\n\r\n```shell\r\ntailscale ssh root@tailscale-on-koyeb\r\n```\r\n\r\nFor more information about Koyeb, the Koyeb CLI, resources, service types, and deployment options, refer to the [Koyeb documentation](https://www.koyeb.com/docs).\r\n\r\n## [Remove ephemeral nodes from a tailnet](https://tailscale.com/docs/install/cloud/koyeb\\#remove-ephemeral-nodes-from-a-tailnet)\r\n\r\nWhen an ephemeral node goes offline, it is automatically removed from your tailnet. You can also control ephemeral node removal using the [`tailscale logout`](https://tailscale.com/docs/reference/tailscale-cli#logout) command to either manually force the removal or incorporate the command into the [`tailscaled`](https://tailscale.com/docs/reference/tailscaled) Tailscale daemon. For more information, refer to [Ephemeral nodes](https://tailscale.com/docs/features/ephemeral-nodes#faq).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Tailscale on Koyeb

\n

Last validated: Jan 5, 2026

\n

Koyeb is a serverless platform for seamlessly deploying AI applications and databases on high-performance infrastructure, including CPUs, GPUs, and Accelerators around the world.\r\nYou can add Tailscale to a Koyeb application to let your Koyeb Services communicate with other devices and services in your tailnet.

\n

Step 1: Generate an auth key to authenticate your Service on Koyeb

\n

Start by generating an auth key to let your Koyeb service join your tailnet.

\n

Open the Keys page of the admin console and select Generate auth key. It's best practice to use a reusable and pre-authorized ephemeral key for this purpose because it automatically cleans up devices after they shut down.

\n

\"Tailscale's

\n

The Pre-approved option will only display in the dialog if device approval is enabled in your Tailscale network.

\n

Next, open a terminal and use the following command to create a Koyeb Secret to securely store the auth key on Koyeb.

\n
koyeb secrets create TAILSCALE_AUTHKEY -v \"tskey-<key>\"\n
\n

Pass this Secret using an environment variable to your Koyeb Service to authenticate your application and join your tailnet.

\n

Step 2: Configure your Dockerfile to install Tailscale

\n

Next, build a multistage Dockerfile with two stages:

\n\n

In your Dockerfile:

\n
FROM alpine:latest as builder\r\nWORKDIR /app\r\nCOPY . ./\r\n# This is where you build the application code as well.\r\n\r\n# https://docs.docker.com/develop/develop-images/multistage-build/#use-multi-stage-builds\r\nFROM alpine:latest\r\nRUN apk update && apk add ca-certificates iptables ip6tables && rm -rf /var/cache/apk/*\r\n\r\n# Copy binary to production image.\r\nCOPY --from=builder /app/start.sh /app/start.sh\r\n\r\n# Copy Tailscale binaries from the tailscale image on Docker Hub.\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscaled /app/tailscaled\r\nCOPY --from=docker.io/tailscale/tailscale:stable /usr/local/bin/tailscale /app/tailscale\r\nRUN mkdir -p /var/run/tailscale /var/cache/tailscale /var/lib/tailscale\r\n\r\n# Run on container startup.\r\nCMD [\"/app/start.sh\"]\n
\n

The Dockerfile specifies the /app/start.sh script as the initial process to run. This script starts Tailscale, then runs the application binary. This is where you use the TAILSCALE_AUTHKEY variable you defined when you generated an auth key.

\n

Create a new file named start.sh in the root directory of your application and add the following content to the file to start Tailscale and launch your app:

\n
#!/bin/sh\r\n# Start Tailscale\r\n/app/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/var/run/tailscale/tailscaled.sock &\r\n/app/tailscale up --ssh --auth-key=${TAILSCALE_AUTHKEY} --hostname=tailscale-on-koyeb\r\n\r\n# Start your app\r\n/app/my-app\n
\n

You pass the --ssh flag to /app/tailscale up to authorize SSH connections to the node. This will let you ensure everything is working as expected and let you connect to the node using SSH from your tailnet. Refer to Tailscale SSH documentation for more information.

\n

Save the file. You're ready to deploy.

\n

Step 3: Deploy your app to Koyeb

\n

To deploy the application on Koyeb, run the following command from your application's root directory. This command creates and deploys a new Koyeb service that connects to your tailnet:

\n
koyeb deploy . myapp/main --instance-type small --region was --type worker --archive-builder docker --env TAILSCALE_AUTHKEY=@TAILSCALE_AUTHKEY --privileged\n
\n

Run the following command to use SSH to confirm you can connect to the service:

\n
tailscale ssh root@tailscale-on-koyeb\n
\n

For more information about Koyeb, the Koyeb CLI, resources, service types, and deployment options, refer to the Koyeb documentation.

\n

Remove ephemeral nodes from a tailnet

\n

When an ephemeral node goes offline, it is automatically removed from your tailnet. You can also control ephemeral node removal using the tailscale logout command to either manually force the removal or incorporate the command into the tailscaled Tailscale daemon. For more information, refer to Ephemeral nodes.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}