Tailscale subnet router intermittent connection issues

[olivier]

Hello,

I’ve set up a Tailscale subnet router following the example here: GitHub - render-examples/tailscale: Tailscale Subnet Router on Render. Our service is basically a copy of the example.

It works, but every so often (can be as low as 15 minutes or as high as few hours) the service becomes unhealthy before immediately coming back up:

Server unhealthy for render-subnet-router
| dial tcp 10.1x.x.x:10000: connect: connection refused

Server healthy for render-subnet-router
| Server healthy for render-subnet-router

Looking at the logs, it looks like the Tailscale service is restarting at those times, which would explain why it’s briefly unavailable. However I have no idea what’s causing it to restart in the first place. Has anyone observed something similar when using Tailscale on Render?

[John_B]

Hey Oliver,

I was actually experiencing exactly this behaviour myself for a Tailscale router I have deployed. We’ve made some updates to the repo last week including changing the service type to a background worker instead of a private worker and since then I’ve not see any repeats of the server unhealthy. If you’ve deployed directly from our repo you may find you have a new background worker service that you’ll need to reauth to tailscale, approve the subnets and hopefully things will improve,

Regards,

John B

[olivier]

Thanks John! I’ve updated our router accordingly, hopefully it will behave better now. I’ll monitor and report back.

Small nit, it looks like we are not able to ping machines in the subnet:

May 23 09:24:17 AM  2022/05/23 16:24:17 exec ping of 10.x.x.x failed in 55.32µs: exec: "ping": executable file not found in $PATH

I’ve added the iputils-ping package to the Docker image, but then it fails with:

May 23 09:44:32 AM  2022/05/23 16:44:32 exec ping of 10.x.x.x failed in 335.29µs: fork/exec /bin/ping: operation not permitted

I suspect Render containers do not have the CAP_NET_RAW capability.