If tailscale inside a container allows you to talk to it via “direct” connection and not a derp proxy, then it will offer you better service isolation (can set the tailscale ACLs for this specific service) without sacrificing performance.

Tailscale pushes for it because it just ties you in more. It allows to to utilize the ACLs better, to see your thing in their service mesh, and every service will count against the free node limit.

In practice, I often do both. E.g. I’ll have my http ingress exposed to tailscale and route a bunch of different services through it at a single tailscale node, where the access control is done by services individually. But I’ll also run a pod-to-pod tailscale between two k8s clusters because tailscale ACL is just convenient.

From my experience with tailscale so far - there are so many different ways to have it configured well. If it works well for you having it on the host, then go for it. I have home assistant in a VM with tailscale and tailscale on the (windows) host. This works well for my needs and I don't mind having it running "twice"

Maybe you get the possibility of routing all traffic from a container (or all the containers in that namespace/network) over the tailnet this way? With the host method, you'd need the host to use the exit node too.

I only have experience trying to run two Tailscale containers on the same machine and hit so many roadblocks that running it containerized just wasn’t worth it.

Containerizing is probably only worth it if you have an explicit need for it.

I was hable to include the taislcale image inside every composer of the web apps I’m using in Docket and have their own magic dns and ip. Even turn on funnel from inside the container and get endcription to the internet direct access. There is a guide https://tailscale.com/kb/1282/docker/

Does the tailscale IP of the host change?