macOS hosted runner does not route traffic through exit node
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- github-actions, macos, typescript
- Domain
- ci-cd, devops, networking
Research direction
Start by reproducing the workflow with tailscale/github-action@v4 on macos-15, using the documented tailscale set --exit-node command, and compare its egress IP with ubuntu-latest. Determine whether macOS hosted runners support exit-node routing; done means either identifying a required change that makes the macOS path route correctly or documenting the confirmed platform limitation.
Written by the indexing model from the issue text.
Description
Environment
- Runner:
macos-15 - Action:
tailscale/github-action@v4 - Auth: OIDC / Workload Identity Federation
- Exit node configured after connect:
sudo tailscale set --exit-node=<node> --accept-routes
Observed behavior
Tailscale connects successfully, and tailscale set --exit-node=... also succeeds.
However, outbound traffic does not appear to use the exit node on GitHub-hosted macOS runners:
- tailscale netcheck reports public IPv4 in the 13.105.117.x range
- curl ifconfig.me returns 13.105.117.x
- Expected: the public IP of the configured exit node
- Actual: the the GitHub-hosted runner public IP
We also verified that an HTTPS request to an external service still appears to originate from the runner IP rather than the exit node.
Comparison with Ubuntu
Using the same workflow and the same exit node:
| Runner | curl ifconfig.me | Result |
|---|---|---|
| ubuntu-latest | exit node public IP | Works |
| macos-15 | the GitHub-hosted runner public IP (13.105.117.x) | Not routed |
Notes
- The v4.0.0 macOS DNS fix does not appear to address this case.
- This does not look like a DNS resolution failure: requests resolve and complete, but egress IP does not switch to the
exit node.
Question
Is exit node routing expected to work on GitHub-hosted macOS runners, or is this currently unsupported/limited by the macOS runner environment?
- Dominant language
- TypeScript
- Stars
- 938
- Forks
- 137
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from tailscale/github-action
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
tailscale/github-action#283 · 1 comment · 1 reaction ·
-
fr
Difficulty 3/5 1-2 days Newbie friendliness 68/100
tailscale/github-action#317 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
tailscale/github-action#316 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
tailscale/github-action#315 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 76/100
tailscale/github-action#313 · 1 reaction ·
All issues in tailscale/github-action
Similar issues
-
clawsweeper:linked-pr-open clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:message-loss issue-rating: 🦞 diamond lobster maturity:stable P2
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#616 ·
-
ZCode 3.14.3 に対応する Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
supermomonga/zcode-acp#24 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
growthbook/growthbook#7100 ·
-
triage
Difficulty 1/5 1-3 hours Newbie friendliness 88/100