Problem running Tailscale in AWS Lambda container

Containers in Tailscale
#1

I’m trying to build an AWS Lambda container (based on a couple of my existing Python functions) to use Tailscale, so I can stop exposing my home automation server directly to the Internet. I’m following the instructions here:

Tailscale on AWS Lambda · Tailscale

Only using the more specific public.ecr.aws/lambda/python:3.9 base image. The resulting container builds fine, but when running it to test tailscaled fails to start with the following error:

safesocket.Listen: listen unix /var/run/tailscale/tailscaled.sock: socket: permission denied

unless I run the container with --privileged, which obviously won’t work on Lambda. I was under the impression that this wouldn’t be needed when tailscale was using user-mode networking?

Any thoughts on how can I get this working?

#2

Are you in fact using userspace networking? It sounds like you’re not, and you’d need to pass the --tun=userspace-networking flag to tailscaled.

#3

Unfortunately yes. My bootstrap script is:

#!/bin/sh

mkdir -p /tmp/tailscale
/var/runtime/tailscaled --tun=userspace-networking --socks5-server=localhost:1055 &
/var/runtime/tailscale up --authkey=${TAILSCALE_AUTHKEY} --hostname=aws-lambda-app --accept-routes
echo Tailscale started
export ALL_PROXY=socks5://localhost:1055/
sleep 1h

Which as you can see has that flag in it. (Leaving it off generates the tun interface error, as expected.) This seems to be referencing an error finding the tailscaled runtime socket, which it seems to lack permission to create, despite being root inside the container.