waazaafr/garage-s3-tailscale repository overview

⁠Garage S3 with Tailscale

A Docker image for running Garage, a distributed object storage service compatible with Amazon S3, with integrated Tailscale client for secure networking. Garage is made by deuxfleurs: https://garagehq.deuxfleurs.fr⁠

⁠Features

• Based on official Garage releases
• Alpine Linux for minimal footprint
• Integrated Tailscale client for secure mesh networking
• AWS CLI pre-installed for easy S3 operations
• Automatic configuration generation
• Multi-architecture support (amd64, arm64)

⁠History

⁠08/09/2026

• Garage v2.3.0 -> v2.4.1
• process-compose update
• tailscale update
• process-compose now worked on arm64

⁠04/08/2026

• added webui for Garage infos

To enable it you must:

• add a variable WEBUI_ENABLED on "true"
• add a port map to the 4080 tcp of the container

⁠Updates

New releases follow the Garage releases from DeuxFleurs.

Their changelog is available here: https://git.deuxfleurs.fr/Deuxfleurs/garage/releases⁠

⁠Quick Start

docker run -d
    --name garage
    --cap-add=NET_ADMIN
    --cap-add=SYS_MODULE
    --device=/dev/net/tun
    -p 9000:9000
    -p 3901:3901
    -p 3902:3902
    -p 3903:3903
    -p 4080:4080
    -v /path/to/config:/config
    -v /path/to/data:/data
    -v /path/to/meta:/meta
    -v /path/to/tailscale_store:/var/lib/tailscale
    -e TS_AUTHKEY="tskey-auth-xxxxx"
    -e TS_HOSTNAME="garage-node1"
    -e ADMIN_TOKEN="your-secure-token"
    -e WEBUI_ENABLED="true"
    waazaafr/garage-s3-tailscale:latest

⁠Environment Variables

⁠Required Variables

⁠Optional Variables

Note: The Tailscale IP address is automatically detected from the tailscale0 interface and does not need to be manually configured.

⁠Volumes

• /config – Garage configuration (garage.toml and secrets)
• /data – Object storage data (ensure sufficient space)
• /meta – Metadata storage
• /var/lib/tailscale – Tailscale state persistence

⁠Ports

• 9000 – Garage internal RPC
• 3901 – Garage public RPC
• 3902 – S3 web interface
• 3903 – Admin API
• '4080' - WebUI if enabled

⁠Container Capabilities

The container requires the following capabilities for Tailscale to function:

• NET_ADMIN – Network administration
• SYS_MODULE – Load kernel modules
• /dev/net/tun – TUN/TAP device access

⁠Configuration Behaviour

On container start:

1. Tailscale Connection: The container connects to your Tailscale network using the provided TS_AUTHKEY and TS_HOSTNAME.
2. IP Detection: The Tailscale IP address is automatically detected from the tailscale0 interface.
3. Configuration Generation:
   • If /config/garage.toml does not exist, a new configuration is generated.
   • If RPC_SECRET is empty, a random 64-character hexadecimal secret is generated.
4. Configuration Update: If /config/garage.toml exists, it is checked against current environment variables and updated only if values differ.

⁠Tailscale Authentication Key

Generate a Tailscale auth key from your Tailscale admin console:

1. Go to https://login.tailscale.com/admin/settings/keys⁠
2. Generate a new auth key (reusable and non-expiring recommended for containers)
3. Use this key as TS_AUTHKEY

=======================================================================

Feel free to join me on https://discord.gg/p9xkjEw8ts⁠⁠⁠

If you like this, consider buing me a coffee:

https://buymeacoffee.com/waazaa⁠⁠⁠

https://ko-fi.com/waazaa⁠

If you need an UnRAID license follow this link: https://unraid.net/pricing?via=4c3f80⁠⁠⁠