Managed coordination removes most WireGuard bookkeeping
Tailscale connects devices across routers, offices, and cloud networks without asking users to maintain a traditional VPN gateway. Install a client, authenticate it, and the device joins a private network called a tailnet. WireGuard protects the data path, while Tailscale handles identity, addresses, keys, peer discovery, access rules, NAT traversal, and relay fallback.
Peers communicate directly when network conditions allow. If firewalls prevent that, traffic can pass through a DERP relay. A connection can therefore work while performing worse than expected, and operators should learn to inspect whether a path is direct or relayed. The product removes most tunnel configuration, but it does not remove network diagnosis.
The repository excludes the coordination service and some GUIs
This checkout contains the tailscaled daemon, the tailscale command, and most cross-platform client code. The daemon runs on Linux, Windows, and macOS, with varying FreeBSD and OpenBSD support. Mobile apps reuse code from here, though their interface code lives in separate repositories. The client carries a BSD 3-Clause license.
Two omissions determine whether the project fits strict open-source requirements. The graphical wrappers for macOS and Windows are closed source. More importantly, Tailscale's coordination server is proprietary. The open DERP relay is present, but compiling the daemon does not reproduce the service that distributes peer and policy state. Headscale exists for users who want an independently maintained replacement control server.
What happened when we ran it
Our sandbox installed 1,012 Go packages in 192 seconds at commit de9ec7e. The build succeeded in 427 seconds. The checkout itself held 2,775 files, roughly 594,387 source lines, and occupied 21.3 MB. Source compilation is straightforward in shape, but it is not a tiny dependency or time commitment.
Tests ended with exit code 1 after 405 seconds. The harness counted 117 passed and 2 failed out of 119. The supplied tail lists successful packages such as wgengine/magicsock, wgengine/netstack, wgengine/router, and wgengine/wgcfg, then ends with FAIL. It does not identify the failed packages or assertions, so we cannot responsibly name a cause.
We ran this in an unprivileged Debian container with 3 CPUs, 8 GB of RAM, no secrets, and the Go 1.24 Bookworm image. The repository scan found 24 CI workflow files and a Dockerfile, but no conventional tests directory. The README now requires Go 1.26, which differs from our sandbox image. The provided log does not establish whether that difference caused either failure.
Official packages are easier than the 619-second build and test cycle
Tailscale publishes packages and applications for common systems, which is the right first route for users. Creating an account and authenticating devices gets a small tailnet working quickly. Source builders need the current Go release, and distribution maintainers are asked to use build_dist.sh or reproduce its version stamping so bug reports carry commit details.
The serious work begins after enrollment. Replace any permissive starting policy, map users and devices, decide how tags are assigned, and plan key expiry. Subnet routers, exit nodes, split DNS, unattended servers, and automation credentials each add a lifecycle. None of this is unusual for network access, but the short demo should not be confused with a finished security design.
Open reports justify staged infrastructure upgrades
Open issue 20916 describes an egress ProxyGroup service on operator v1.102.2 repeatedly losing its Configured state after an upgrade. The reporter saw a sibling cluster behave correctly and rolled the affected cluster back. That is one environment, not proof of a universal regression, but Kubernetes traffic paths deserve canary upgrades and a tested rollback.
Key lifecycle also needs rehearsal. Issue 10776 reports tags disappearing after a device was reauthenticated following key expiry. The report covers Windows and Linux clients and remains open. A large tailnet should test expiration on tagged non-production nodes before applying the same policy everywhere.
Non-systemd Linux users face a less polished path. Issue 9502 requests support for Devuan and similar distributions, with discussion still updated in August 2026. Operators on such systems should confirm service management, startup, upgrades, and log collection before assuming a Debian-family package is enough.
Version 1.102.3 is current, with a very large public queue
GitHub showed 35,580 stars and 4,484 combined open issues and pull requests when fetched. The repository was pushed on August 26, 2026, and v1.102.3 was released on August 20. Same-day issue and pull-request activity covered exit-node selection, Linux network hardware, Kubernetes traffic, Android DNS, and connection handling.
The large open count is not a bug count. It reflects public support across desktop, mobile, servers, containers, networking hardware, and the hosted service. The 24 CI workflow files and frequent releases show sustained engineering, while our 2 failed test packages are still a reason for a packager to inspect the full log.
Tailscale is easiest to recommend when managed coordination is an advantage. It gives developers private access without publishing ports or maintaining peer lists. Strict self-hosters may reasonably reject the proprietary control plane. Everyone else should use official packages, write least-privilege policy, stage upgrades, and verify whether important traffic uses a direct path.