Unable to access service on local server via Tailscale in docker from remote

Question

I'm running several apps in Docker on a Raspberry Pi (local server) and want to access them via Tailscale, but I keep getting "Connection refused" when trying to reach them for example via the Tailscale IP (tailscale-ip:5055).

• From RPi (works)
  • curl http://127.0.0.1:5055/login # Success
• From Mac (fails)
  • tailscale ping tailscale-ip -> works fine
  • curl http://tailscale-ip:5055/login -> # "Connection refused"

My Setup:

Docker Compose (docker-compose.yml)

    services:
      tailscale:
        image: tailscale/tailscale:latest
        hostname: xyz
        container_name: tailscale
        environment:
          - TS_AUTHKEY=tskey-auth-...
          - TS_STATE_DIR=/var/lib/tailscale
          - TS_USERSPACE=false
        volumes:
          - ./configs/tailscale/state:/var/lib/tailscale
        devices:
          - /dev/net/tun:/dev/net/tun
        cap_add: 
        - net_admin
      restart: always
      networks:
        - default
  overseerr:
    image: lscr.io/linuxserver/overseerr:latest
    container_name: overseerr
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Berlin
    ports:
      - 5055:5055
    volumes:
      - ./configs/overseerr:/config
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.overseerr.rule=Host(\\some.record.local\`)"\`
      - "traefik.http.routers.overseerr.entrypoints=websecure"
      - "traefik.http.routers.overseerr.tls=true"
      - "traefik.http.services.overseerr.loadbalancer.server.port=5055"
    restart: always
    networks:
      - traefik\_proxy
      - default

networks:
  traefik_proxy:
    external: true
  default:
    driver: bridge

What I’ve Tried

1. Verified Tailscale connectivity (Mac -> Rpi)
   • tailscale ping tailscale-ip works.
   • Tailscale logs show no errors.
2. Checked Docker networking (on Rpi)
   • Confirmed Overseerr is listening on 0.0.0.0:5055 (ss -tulnp).
   • Tried attaching Overseerr to both traefik_proxy and default networks.
3. Tested without Traefik
   • Temporarily removed traefik_proxy network and used only default.
   • Still no connection via Tailscale IP.
4. Firewall checks (on Rpi)
   • iptables shows port 5055 is open.
   • ufw is already disabled.
5. Host networking test
   • Set network_mode: host for Overseerr -> also not working

Did I miss a setting?
Thanks in advance!

Answer 1

I figured it out.
The tailscale service needs networking mode host so that each port is exposed properly to tailscale