tailscale container cannot reach other containers by name — only by IP

What is the issue?

A tailscale’s container cannot reach other containers on the user-created docker network by container name (i. e. internal docker name resolution doesn't work) — only by ip address.

That creates a problem when you use tailescale as a side-car container to a reverse-proxy — you can reverse-proxy to services running in the tailnet (via tailsclae domain) but you cannot easily reverse-proxy to locally run services at the same time simply via [container_name]:[port] — you would have to reverse-proxy to an [IP]:[port] and have static IP configuration for the docker network and corresponding containers.

Use-case: running tailscale container on a VPS as a sidecar to a caddy container and reverse-proxying to a service hosted in the home lab and to a service hosted on VPS itself at the same time.

Steps to reproduce

1. Run tailscale with a few other containers on the same docker network (my example below):

networks:

  proxy:
    name: proxy
    driver: bridge
    enable_ipv6: true

services:

  caddy-proxy:
    container_name: caddy-proxy
    image: docker.io/gentlehoneylover/caddy-godaddy-cloudflare
    restart: unless-stopped
    depends_on:
      - tailscale
    environment:
      - CLOUDFLARE_API_TOKEN=${CF_CADDY_TOKEN}
    volumes:
      - ${VLM_PATH}/caddy/Caddyfile:/etc/caddy/Caddyfile
      - ${VLM_PATH}/caddy/data:/data
      - ${VLM_PATH}/caddy/config:/config
    network_mode: service:tailscale

  tailscale:
    container_name: tailscale
    hostname: my-vps
    image: docker.io/tailscale/tailscale:latest
    restart: unless-stopped
    environment:
      - TS_AUTHKEY=${TS_KEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
      - TS_EXTRA_ARGS=--advertise-exit-node --accept-routes
      - TS_ACCEPT_DNS=true
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ${VLM_PATH}/tailscale/state:/var/lib/tailscale
    cap_add:
      - net_admin
      - sys_module
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv6.conf.all.forwarding=1
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      - proxy

  node_exporter: 
    container_name: node_exporter
    image: docker.io/prom/node-exporter:latest
    restart: unless-stopped
    volumes:
      - ${VLM_PATH}/node_exporter/:/etc/node_exporter:ro
      - /:/host:ro,rslave
    command: '--path.rootfs=/host --collector.systemd --collector.processes'
    pid: host
    networks:
      - proxy

For reference, the docker network inspect proxy shows the following containers:

"Containers": {
            "06ee4e681d7d541a7689836e7384cfe4804c1441300e45cfc0fa7ad48a559f5d": {
                "Name": "tailscale",
                "EndpointID": "998fa7035bf06ec8a9ca2a1b7fd33588426e24ce8aacef3781677a291ccd41c0",
                "MacAddress": "5e:a8:02:44:ca:dd",
                "IPv4Address": "172.19.0.2/16",
                "IPv6Address": "fdd3:a99c:7b36:1::2/64"
            },
            "c8f3bb366fb57f5802e8fef386067417b13c46d9492a8f61939ea9011301d9ed": {
                "Name": "node_exporter",
                "EndpointID": "3e7bbe849cce72befe47905345b7b98ed3041bfb8e647bfd97aeed5c4eb5496a",
                "MacAddress": "ca:ac:5b:2d:dc:0c",
                "IPv4Address": "172.19.0.3/16",
                "IPv6Address": "fdd3:a99c:7b36:1::3/64"
            }
        },

2. Enter the tailscale (or caddy) container via docker exec -it tailscale sh
3. Inside the container, run ping node_exporter and the output you get is ping: node_exporter: Name does not resolve.
4. However, if you run ping 172.19.0.3 or ping fdd3:a99c:7b36:1::3 the ping runs successfully.

The expectation is that ping node_exporter correctly resolves to node_exporter's IP address (like it normally would in any other docker container).

Are there any recent changes that introduced the issue?

N/A

OS

Linux

OS version

Ubuntu 24.04.2 LTS

Tailscale version

1.80.3

Other software

Docker version 28.0.2, build 0442a73

Bug report

BUG-470cb79ad6c1033297f41fc2191d03d5a69fef6b003d386adaa0ef6f12886fa3-20250324134130Z-c9e749238b010841