October 2021 Summaries

The October Tailscale newsletter highlights various community contributions, updates, and improvements made by the Tailscale team, emphasizing the integration of Tailscale with different platforms and its enhanced functionality for developers. Key developments include the creation of an Ansible role for Tailscale installation, a Windows updater using PowerShell, enhancements for Kubernetes compatibility, and the addition of Tailscale to the Synology Package Center. The team also focused on improving support for container workloads, battery performance on mobile devices, and backward compatibility with older Android versions. The newsletter invites community engagement through feedback, virtual office hours, and highlights ongoing efforts in documentation and hiring for technical support roles.

Tailscale integrates seamlessly with Coder to enhance the development experience by enabling secure and low-latency access to various resources, such as package registries and databases, and facilitating collaboration through easy sharing of development environments. Coder, a platform for remote development workspaces, allows developers to define their workspaces using Dockerfiles, and by incorporating Tailscale, developers can achieve bidirectional access between their workspace and other devices on the tailnet. This setup supports robust access controls and observability, making it suitable for tasks like pair programming, code reviews, and accessing cloud or on-premises resources. Additionally, Tailscale is compatible with code-server, an open-source project for running VSCode in the browser, allowing developers to securely connect to private servers using a subnet router. This integration ensures that developers can work efficiently and securely, whether on a mobile device or a desktop, and maintain all necessary configurations and extensions.

Tailscale provides a seamless way for developers utilizing GitHub Codespaces to maintain access to essential resources while working in remote development environments. By integrating Tailscale into a development container, developers can ensure consistent connectivity to their tailnet, facilitating collaboration and access to internal tools and services. This setup involves adding a Tailscale client and using a reusable authentication key, which can be stored as a Codespaces secret, to maintain persistent connections across different environments. This integration allows developers to share resources, pair program, and access production databases securely, as demonstrated by Jasper, a real estate investment company using Tailscale for efficient and secure development processes. Tailscale's compatibility with GitHub extends beyond Codespaces, enabling authentication through GitHub accounts and supporting secure operations via GitHub Actions, while also being applicable to development containers in environments beyond GitHub Codespaces.

Remote development can be challenging due to the need for reliable access to resources from various locations, but the integration of Tailscale and Gitpod aims to simplify this process by enabling seamless connectivity between development workspaces and necessary resources. By having Tailscale available by default in Gitpod workspaces, developers can easily connect to cloud and on-premises resources, collaborate with colleagues, and even pair program securely. Gitpod's automated cloud development environments are enhanced by Tailscale's private networking capabilities, allowing for efficient remote collaboration without typical "works on my machine" issues. Additionally, Gitpod Professional is offered free for a year to Tailscale customers, encouraging the use of this integrated solution for improved remote development experiences.

In an effort to improve remote meetings, Tailscale, a fully remote company, has implemented a novel approach inspired by Chelsea Troy's insights, which involves using a virtual environment in Teamflow where participants queue at a microphone on a 2D plane to speak, akin to a red carpet setup. This method effectively utilizes existing social norms, making it intuitive and reducing interruptions, as the physical act of queuing and waiting mirrors real-world interactions and accommodates internet latency. This system addresses common issues in remote meetings, such as people talking over each other and unclear transitions between speakers, by providing clear visual cues and a structured order, resulting in smoother and more efficient communication. While it is not a complete solution to all remote meeting challenges, it represents a significant improvement over traditional methods, which is particularly noteworthy in the often challenging domain of virtual meetings.

Tailscale has announced its official support for Synology in the Synology Package Center, allowing users to securely access their Synology NAS from anywhere, without the need for complex configurations like opening firewall ports. This integration addresses the high demand from users who wanted seamless remote access and file-sharing capabilities on their Synology devices. Tailscale provides features such as web-based logins, access control lists, and the ability to use the NAS as a subnet router or an exit node, effectively turning the NAS into a versatile tool for both personal and professional use. This development eliminates the need for traditional VPN configurations and offers a straightforward installation process, enabling users to create a secure, Dropbox-like environment without hosting data in the cloud. The collaboration has been made possible with the help of contributions from Guilherme de Maio, and the package is now officially maintained by Tailscale.

Tailscale has made significant strides in integrating with Kubernetes and container ecosystems, providing a managed Docker image that facilitates its deployment. This image is available on Docker Hub and GitHub Packages, allowing users to run Tailscale within containers without requiring traditional Linux capabilities like CAP_NET_RAW and CAP_NET_ADMIN, thanks to its userspace networking feature. With the release of Tailscale v1.16, additional features such as a built-in HTTP proxy server enhance its utility on platforms like Heroku and Google Cloud Run. Users can add containers as ephemeral nodes using authentication keys and manage these through Kubernetes secrets, enabling seamless integration with existing infrastructure. Tailscale can also function as a sidecar container, providing flexibility for deployments where security or vendor constraints exist. Furthermore, it acts as a proxy within Kubernetes clusters, facilitating secure workload sharing across networks using MagicDNS, thereby avoiding exposure on the public internet.

In the October 12, 2021 blog post, the authors discuss improvements to the admin console, specifically focusing on device approval and key expiry settings. Device approval requires administrative authorization for any new device added to the network, enhancing security by ensuring only approved devices can connect. Additionally, the admin console now allows the setting of key expiry periods, a feature that mandates periodic reauthentication of network devices to confirm their continued validity, thus maintaining network integrity. While the default key expiry is set at 180 days, administrators have the flexibility to adjust this period between 3 and 180 days to suit their security needs, with a potential reduction of the default expiry time planned for the future.

Tailscale 1.16 introduces several enhancements, including improved container support, updates to HTTP and SOCKS5 proxy capabilities, and better mobile battery efficiency. This release allows node state storage as a Kubernetes secret, eliminating the need for separate persistent storage for containers, and enables the HTTP proxy server operation alongside the existing SOCKS5 proxy support. Taildrop now supports older Android versions, enhancing file-sharing capabilities for devices as old as Android 6. The release also emphasizes expanded documentation, introducing new Knowledge Base articles to aid in setting up private access to various cloud services like Azure, AWS, Google Compute Engine, Oracle Cloud, and Hetzner servers using Tailscale.

Tailscale's blog post discusses the challenges and solutions related to optimizing memory usage for their iOS app, which operates as a Network Extension and faces a stringent 15MB memory limit. The team initially tackled memory inefficiencies by analyzing their app's baseline operation, optimizing the Go runtime's garbage collector, and adjusting system thread usage. Despite these efforts, they discovered that iOS's memory accounting—with a significant portion attributed to relocations in the __DATA_CONST category—was a major factor, leading them to improve the Go linker to reduce relocations, resulting in memory savings. Their changes not only benefited their app but also enhanced Go's performance across different systems. In an unexpected twist, while their linker improvements saved roughly 1MB, the release of iOS 15 provided an additional 35MB of memory, alleviating their constraints significantly.