gsxdsm e6121bc8e2 fix: make container tailscaled opt-in via a --tailscale entrypoint flag ...

Starting the daemon unconditionally gave every container a process, a listening
socket, and an identity in someone's tailnet that it never asked for. Most
containers never use remote access, so the daemon is now opt-in.

- The entrypoint consumes a leading `--tailscale` argument (or FUSION_TAILSCALE=1,
  with `--no-tailscale` to override it back off) and strips it from the argument
  list, so everything after it stays a normal Fusion CLI invocation.
- Arguments are rotated through shift/append rather than string concatenation, so
  values containing spaces survive as single argv entries.
- Replaces the FUSION_DISABLE_TAILSCALED opt-out, which is redundant now that the
  default is off.
- Document the flag, the userspace-networking mode (no NET_ADMIN/tun caps), the
  one-time `tailscale up`, and the /home/node mount that persists that login.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-22 19:16:00 -07:00

2.8 KiB

Executable File

Raw Blame History

View Raw