> Deploying Containerized Code-Server with Tailscale Access

$ docker compose up -d
[+] Running 1/1
 ✔ Container code-server    Started // Tailnet Ready

Running an IDE in the cloud or on a dedicated homelab server gives you development environment portability anywhere you go. However, exposing a remote development interface directly to the public internet is a security nightmare.

This guide walks through deploying a containerized Code-Server instance via Docker Compose, backed by persistent storage and secured securely within your private Tailscale network. In case you missed docktail setup, you can check the guide below:

cat /etc/docktail/complete-guide.md

Exposing homelab services securely without opening inbound ports on your home router is the holy grail of self-hosting. While a public reverse proxy like Traefik handles external domain traffic, internal administrative tools, file browsers, and dashboards should remain strictly off the public web. Docktail solves this by bridging Docker container

LinuxpadDennis Agyepong

1. Docker Compose Configuration

Create your compose.yaml file for the LinuxServer.io Code-Server image. This configuration maps persistent configuration storage, sets user permissions, and defines container routing labels.

services:
  code-server:
    image: lscr.io/linuxserver/code-server:latest
    container_name: code-server
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
      - PASSWORD=your_passwd
      - SUDO_PASSWORD=your_passwd
      - PROXY_DOMAIN=vscode.example.com
      - DEFAULT_WORKSPACE=/config/workspace
    volumes:
      - ${DOCKER_VOLUME_STORAGE:-/mnt/docker-volumes}/vscode/config:/config
    restart: unless-stopped
    labels:
      - docktail.service.enable=true
      - docktail.service.name=code-server
      - docktail.service.port=8443
      - docktail.service.service-port=443

2. Deploying the Service

Spin up your container stack in detached mode:

docker compose up -d

Verify that the container is running and healthy:

docker ps --filter name=code-server

3. Integrating with Tailscale

Rather than punching holes in your firewall or setting up complex reverse proxy letsencrypt certificates for public access, you can leverage Tailscale to securely access your code-server container exclusively inside your private tailnet.

1. Ensure Tailscale is active on your host machine and routing traffic correctly.
2. Access the development environment directly using your server's assigned Tailscale IP or MagicDNS hostname on port 8443.
3. Log in using the password defined in your environment variables (akwasi123).

Your development environment is now securely isolated, fully containerized, and accessible from any trusted device on your tailnet.