starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-26 08:26:03 +03:00

[GH-ISSUE #1499] Crawler can’t reach .ts.net Tailscale address (ENETUNREACH) #942

New issue

Open

opened 2026-03-02 11:53:53 +03:00 by kerem · 3 comments

kerem commented

2026-03-02 11:53:53 +03:00

Owner

Originally created by @brao77 on GitHub (May 30, 2025).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1499

Describe the feature you'd like

Hey there,
I’ve got KaraKeep running in a container that shares the network with another container running Tailscale (--network=container:tailscale). Everything works great — KaraKeep and other services in my tailnet are reachable from inside the container.

But when I try to add a link to another self-hosted service that’s only reachable via Tailscale (using a .ts.net hostname), the crawler fails with this:

FetchError: connect ENETUNREACH [tailscale-ip]:443

I can ping the host from the container, and it resolves fine (even works with curl if I add a manual /etc/hosts entry). But obviously that’s not persistent across updates and doesn’t help the crawler/Puppeteer.

Would it be possible to:

Let us pass custom DNS settings to the container? (e.g. use MagicDNS 100.100.100.100)

Or let us configure the crawler to use Puppeteer with something like --host-resolver-rules?

Or just add a way to map hostnames to IPs inside the crawler setup?

This would make KaraKeep play much nicer in Tailscale setups, especially for those of us self-hosting everything. 🙏

Thanks a ton for the awesome project!

Describe the benefits this would bring to existing Karakeep users

Supporting .ts.net (Tailscale) hostnames and custom DNS/IP resolution would make KaraKeep much more flexible for people running self-hosted services in private networks. More and more users rely on Tailscale to securely connect their infrastructure without exposing anything to the public internet. Allowing the crawler to resolve and reach internal Tailscale services would unlock powerful use cases like linking to internal dashboards, password managers, dev tools, or documentation — all without compromising security. This would be a big win for privacy-minded and self-hosting users.

Can the goal of this request already be achieved via other means?

Not really in a practical or persistent way. While it's technically possible to make it work by manually modifying /etc/hosts or installing debugging tools like curl inside the container, these changes are ephemeral — they get wiped on container restarts or updates. Also, since the crawler runs inside the container, workarounds like host-based DNS hacks are brittle and hard to maintain. There’s currently no built-in way to tell KaraKeep how to resolve or route .ts.net hostnames, which limits its usefulness in private networks.

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

Additional context

No response

Originally created by @brao77 on GitHub (May 30, 2025). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1499 ### Describe the feature you'd like Hey there, I’ve got KaraKeep running in a container that shares the network with another container running Tailscale (--network=container:tailscale). Everything works great — KaraKeep and other services in my tailnet are reachable from inside the container. But when I try to add a link to another self-hosted service that’s only reachable via Tailscale (using a .ts.net hostname), the crawler fails with this: **FetchError: connect ENETUNREACH [tailscale-ip]:443** I can ping the host from the container, and it resolves fine (even works with curl if I add a manual /etc/hosts entry). But obviously that’s not persistent across updates and doesn’t help the crawler/Puppeteer. Would it be possible to: Let us pass custom DNS settings to the container? (e.g. use MagicDNS 100.100.100.100) Or let us configure the crawler to use Puppeteer with something like --host-resolver-rules? Or just add a way to map hostnames to IPs inside the crawler setup? This would make KaraKeep play much nicer in Tailscale setups, especially for those of us self-hosting everything. 🙏 Thanks a ton for the awesome project! ### Describe the benefits this would bring to existing Karakeep users Supporting .ts.net (Tailscale) hostnames and custom DNS/IP resolution would make KaraKeep much more flexible for people running self-hosted services in private networks. More and more users rely on Tailscale to securely connect their infrastructure without exposing anything to the public internet. Allowing the crawler to resolve and reach internal Tailscale services would unlock powerful use cases like linking to internal dashboards, password managers, dev tools, or documentation — all without compromising security. This would be a big win for privacy-minded and self-hosting users. ### Can the goal of this request already be achieved via other means? Not really in a practical or persistent way. While it's technically possible to make it work by manually modifying /etc/hosts or installing debugging tools like curl inside the container, these changes are ephemeral — they get wiped on container restarts or updates. Also, since the crawler runs inside the container, workarounds like host-based DNS hacks are brittle and hard to maintain. There’s currently no built-in way to tell KaraKeep how to resolve or route .ts.net hostnames, which limits its usefulness in private networks. ### Have you searched for an existing open/closed issue? - [x] I have searched for existing issues and none cover my fundamental request ### Additional context _No response_

kerem added the

feature request

status/icebox

labels

2026-03-02 11:53:53 +03:00

kerem commented

2026-03-02 11:53:53 +03:00

Author

Owner

@MohamedBassem commented on GitHub (May 31, 2025):

Can't you achieve 1 and 3 using docker directly?

Something like:

services:
  web:
    dns:
      - 100.100.100.100

services:
  web:
    extra_hosts:
      - "example.com:192.168.1.100"
      - "test.local:10.0.0.42"

@MohamedBassem commented on GitHub (May 31, 2025): Can't you achieve 1 and 3 using docker directly? Something like: ``` services: web: dns: - 100.100.100.100 ``` or ``` services: web: extra_hosts: - "example.com:192.168.1.100" - "test.local:10.0.0.42" ```

kerem commented

2026-03-02 11:53:54 +03:00

Author

Owner

@brao77 commented on GitHub (Jun 1, 2025):

Hey, thanks for the quick reply!

Yeah, those options work in theory, but they fall short in practice for Tailscale setups.

extra_hosts means I need to manually map every .ts.net hostname to a Tailscale IP — and those IPs can change. Not fun to maintain.

dns: 100.100.100.100 would be perfect, but it can’t be used together with network_mode: container:tailscale, which is currently the only way KaraKeep can actually reach the tailnet.

So unless I rebuild the image or go with a custom setup, there’s no clean way to make the crawler resolve and reach Tailscale-only URLs out of the box.

Would be awesome if there was built-in support for this kind of use case — it’s getting more common with self-hosted setups.

@brao77 commented on GitHub (Jun 1, 2025): Hey, thanks for the quick reply! Yeah, those options work in theory, but they fall short in practice for Tailscale setups. extra_hosts means I need to manually map every .ts.net hostname to a Tailscale IP — and those IPs can change. Not fun to maintain. dns: 100.100.100.100 would be perfect, but it can’t be used together with network_mode: container:tailscale, which is currently the only way KaraKeep can actually reach the tailnet. So unless I rebuild the image or go with a custom setup, there’s no clean way to make the crawler resolve and reach Tailscale-only URLs out of the box. Would be awesome if there was built-in support for this kind of use case — it’s getting more common with self-hosted setups.

kerem commented

2026-03-02 11:53:54 +03:00

Author

Owner

@kendallm commented on GitHub (Jun 11, 2025):

I used this to set up Tailscale and it's been working great for me.

https://www.youtube.com/watch?v=cCC3PSBCkqk

@kendallm commented on GitHub (Jun 11, 2025): I used this to set up Tailscale and it's been working great for me. https://www.youtube.com/watch?v=cCC3PSBCkqk

kerem referenced this issue

2026-03-02 11:58:51 +03:00

[PR #942] [MERGED] Fix unsync-similar-dependencies error #1716

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#942

No description provided.

Rows
Columns