waazaafr/garage-s3-tailscale repository overview

⁠Garage S3 with Tailscale

A ready-to-run Docker image for Garage⁠, the lightweight, S3-compatible distributed object storage made by Deuxfleurs⁠, with a built-in Tailscale⁠ client.

Your Garage nodes join your tailnet and talk to each other over Tailscale: build a multi-site cluster without opening any port on the internet.

⁠Features

• 📦 Official Garage binary, on Alpine Linux for a minimal footprint
• 🔒 Built-in Tailscale client: the node's Tailscale IP is detected and used automatically
• ⚙️ Automatic garage.toml generation from environment variables
• 🧰 AWS CLI pre-installed (with an s3 alias for aws s3)
• 📊 Optional web UI to monitor your Garage node
• 🖥️ Multi-arch: linux/amd64 and linux/arm64

⁠Tags

New image releases follow the Garage releases⁠ from Deuxfleurs.

⁠Quick start

1. Create an auth key in the Tailscale admin console⁠ (a reusable key is recommended for containers).
2. Start the container:

⁠Docker Compose

services:
  garage:
    image: waazaafr/garage-s3-tailscale:latest
    container_name: garage
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    devices:
      - /dev/net/tun
    ports:
      - "9000:9000"   # S3 API
      - "3901:3901"   # RPC
      - "3902:3902"   # S3 web hosting
      - "3903:3903"   # Admin API
      - "4080:4080"   # Web UI (optional)
    volumes:
      - ./garage/config:/config
      - ./garage/data:/data
      - ./garage/meta:/meta
      - ./garage/tailscale:/var/lib/tailscale
    environment:
      TS_AUTHKEY: "tskey-auth-xxxxx"
      TS_HOSTNAME: "garage-node1"
      ADMIN_TOKEN: "your-secure-token"
      WEBUI_ENABLED: "true"

⁠Docker run

docker run -d \
  --name garage \
  --restart unless-stopped \
  --cap-add=NET_ADMIN \
  --cap-add=SYS_MODULE \
  --device=/dev/net/tun \
  -p 9000:9000 \
  -p 3901:3901 \
  -p 3902:3902 \
  -p 3903:3903 \
  -p 4080:4080 \
  -v /path/to/config:/config \
  -v /path/to/data:/data \
  -v /path/to/meta:/meta \
  -v /path/to/tailscale:/var/lib/tailscale \
  -e TS_AUTHKEY="tskey-auth-xxxxx" \
  -e TS_HOSTNAME="garage-node1" \
  -e ADMIN_TOKEN="your-secure-token" \
  -e WEBUI_ENABLED="true" \
  waazaafr/garage-s3-tailscale:latest

The node then appears in your tailnet as garage-node1, and Garage is reachable on its Tailscale IP as well as on the published ports.

⁠Configuration

⁠Environment variables

Required

Optional

⁠Ports

⁠Volumes

⁠Required container capabilities

⁠What happens at startup

1. Tailscale starts and joins your tailnet with TS_AUTHKEY and TS_HOSTNAME.
2. The Tailscale IP is read from the tailscale0 interface and used as the RPC address of the node: nothing to configure.
3. The Garage configuration is prepared:
   • First start (/config/garage.toml does not exist): it is created from the environment variables; unset optional variables use their defaults, and a random RPC_SECRET is generated if none is given.
   • Next starts: the Tailscale IP, GATEWAY and ADMIN_TOKEN are always re-applied; optional variables are updated only if they are explicitly set, everything else (such as RPC_SECRET) is kept.
4. Garage starts, followed by the web UI if enabled.

⁠Changelog

Garage release notes: git.deuxfleurs.fr/Deuxfleurs/garage/releases⁠

⁠2026-09-08

• Garage v2.3.0 → v2.4.1.
• Updated Tailscale and process-compose.
• Fixed process-compose on arm64.

⁠2026-08-04

• Added an optional web UI showing Garage information. Enable it with WEBUI_ENABLED=true and publish port 4080.

⁠Links

• 💬 Discord: discord.gg/p9xkjEw8ts⁠
• ☕ Buy me a coffee: buymeacoffee.com/waazaa⁠
• ☕ Ko-fi: ko-fi.com/waazaa⁠
• UnRAID license: unraid.net⁠