Using Tailscale with an OrbStack VM on macOS(github.com) Here's an example of how to build an Ubuntu VM using OrbStack on macOS and then connect to the VM through Tailscale SSH using an auth key stored in Apple Keychain. For example, I can create a VM on my Mac mini at home that hosts a git repo or even a Forgejo server. A colleague in my Tailnet can then connect to this VM to clone, push or pull source code changes from a coffeeshop or airliner while not exposing the rest of my Mac mini. |
Docker Desktop and Podman Desktop are both a treadmill made of Lego bricks.
Have you tried Apple's container CLI[0]? I'm still mostly using OrbStack, but container gives me some hope for the future that Apple cares about this experience.
https://robgough.net/multiple-app-instances-with-tailscale
Also has the handy effect of making it super easy to share my dev environment with anyone else on my tailnet, though this could be locked down if needed.
One thing I noticed though, is that even if I set up the VM as a tagged device with limited access rules, if my host machine (the laptop) is connected as my user (which has less limited permissions), the vm uses my host's user permissions, which isn't really what I want. If I disconnect tailscale on the mac and leave the vm tailscale connected it works as intended though - so that's something to look out for.
Also, if you're using orbstack as an agent sandbox, just be aware that they only recently added an option for true filesystem isolation, the default setup doesn't really sandbox effectively.