Docker Port Binding and Tailscale Reachability

When Docker containers bind to 127.0.0.1 (loopback), they are only reachable from the host machine. Tailscale traffic arrives on the tailscale0 interface and cannot reach 127.0.0.1-bound ports.

Detection

From the VPS via Tailscale:

# Port returns 000 (connection refused) — likely 127.0.0.1 binding
curl -s -o /dev/null -w '%{http_code}' --connect-timeout 2 http://100.93.253.36:9925/
# 000

On the home server, verify the binding:

docker inspect <container> --format '{{json .HostConfig.PortBindings}}' | python3 -m json.tool
# {"9000/tcp": [{"HostIp": "127.0.0.1", "HostPort": "9925"}]}

Solutions

Option A: Proxy through home nginx (preferred)

The home server's nginx already has SSL configs for these services on ports 3443-3450. From the VPS, proxy to the home nginx SSL endpoint with SNI:

proxy_pass https://100.93.253.36:3449;   # Mealie via home nginx
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_ssl_name grajmedia.duckdns.org;
proxy_set_header Host grajmedia.duckdns.org;

This works because the home nginx listens on 0.0.0.0:3449 and proxies to 127.0.0.1:9925 locally.

Option B: Rebind container to 0.0.0.0

Stop the container, recreate with 0.0.0.0 binding:

docker stop mealie
docker rm mealie
docker run -d --name mealie \
  -p 0.0.0.0:9925:9000 \
  ... (rest of original options)

Downside: the service becomes accessible on the LAN without SSL. Only do this for services that don't need the home nginx SSL layer.

Option C: SSH tunnel

As a last resort, create an SSH tunnel from VPS to home server:

ssh -L 9925:127.0.0.1:9925 -N -f 100.93.253.36

Then nginx on the VPS proxies to http://127.0.0.1:9925.

Downside: fragile, needs SSH keepalive, adds latency, requires SSH key setup.

Services by binding type (rayserver)

Service	Docker port	Binding	VPS approach
Immich	2283	0.0.0.0	Direct HTTP
Paperless	8010	0.0.0.0	Direct HTTP
Home Assistant	8123	0.0.0.0 (host net)	Direct HTTP
Mealie	9925	127.0.0.1	Home nginx HTTPS proxy
Audiobookshelf	13378	0.0.0.0	Direct HTTP
PocketBase	8091	127.0.0.1	Home nginx HTTPS proxy

2.3 KiB Raw Permalink Blame History