Comparison

DockTail vs DockFlare
Public hostnames or a private tailnet.

DockFlare is a well-built way to put Docker containers on your own domain through Cloudflare Tunnel, with DNS records and Cloudflare Access policies created from labels. DockTail publishes containers as Tailscale Services on your private tailnet. They do different jobs, and this page is about which job each container needs.

Quick start Jump to the table

dockflare.* vs docktail.* labels · Cloudflare Tunnel vs Tailscale Services · no label conflicts, so both can run on one host

How each one works

Three labels each, two different networks.

The same nginx container, published by each tool. The labels look alike. Where the request comes from, and who can send it, does not.

DockFlare

docker-compose.yml 
nginx-webserver:
  image: nginx:latest
  networks:
    - cloudflare-net
  labels:
    - dockflare.enable=true
    - dockflare.hostname=nginx.example.com
    - dockflare.service=http://nginx-webserver:80

browser → Cloudflare edge → tunnel → cloudflared → nginx-webserver:80

DockFlare creates a CNAME for nginx.example.com and an ingress rule on its Cloudflare Tunnel. cloudflared reaches the app by name on the shared cloudflare-net network. Add a dockflare.access.* label for a login; without one the hostname is public. Runs next to the DockFlare master, Redis, a docker-socket-proxy and the cloudflared container it manages. DockFlare docs

DockTail

docker-compose.yml 
nginx:
  image: nginx:latest
  # no ports, no extra network
  labels:
    - docktail.service.enable=true
    - docktail.service.name=nginx
    - docktail.service.port=80

tailnet device → host tailscaled → container IP:80

DockTail advertises the service from the host's Tailscale and proxies straight to the container's Docker network IP. It answers at nginx.<tailnet>.ts.net for devices your ACLs allow, and nothing is public. Needs Tailscale on a tagged host (or a sidecar), tags and auto-approvers in your tailnet policy, and an OAuth client for automatic service definitions. DockTail quick start

Key differences

The three differences that decide it.

Who can reach it

DockFlare creates a public hostname in your Cloudflare zone. A Cloudflare Access policy puts a login in front of it, but a container with no access label is public. A DockTail service is only reachable from tailnet devices your ACLs allow. Public access is a separate opt-in: Funnel labels on the container plus the funnel node attribute in your tailnet policy.

Where TLS ends

With DockFlare, visitors connect to Cloudflare, which terminates TLS at its edge with its edge certificate and forwards the request down the tunnel to cloudflared. With DockTail, tailnet traffic is WireGuard-encrypted from the client to the host's Tailscale, which can also serve HTTPS with a Tailscale certificate (service-port 443). For Funnel, TLS ends on your node, and the Funnel relay cannot decrypt the traffic.

What you run

DockFlare needs a domain in your Cloudflare account, an API token that can write tunnels, Access policies and DNS, and a stack of master, Redis, docker-socket-proxy and cloudflared with a state volume. In return you get a web UI and multi-host agents. DockTail is one stateless container next to tailscaled on a tagged host, plus tags and an auto-approver in your tailnet policy, and an OAuth client if it should create Service definitions for you. It has no UI of its own.

Side by side

DockTail and DockFlare, row by row.

A ✅ means the tool does it out of the box, not that it is the better tool. Several of DockFlare's ✅ rows are exactly why you would pick it.

DockTail DockFlare
Configured via Docker labels ✅ docktail.* labels ✅ dockflare.* labels, plus rules in the web UI
Private to your own devices by default ✅ Tailnet devices your ACLs allow ❌ Public unless an Access policy applies
Hostname on your own domain ❌ Tailnet names under ts.net ✅ Any hostname in your Cloudflare zone, paths and wildcards
Public internet access ⚠️ Funnel labels plus the funnel node attribute; host's own ts.net hostname, ports 443, 8443 or 10000 ✅ What it is built for
Login page in front of an app ⚠️ Tailnet identity and ACLs; Funnel is open to anyone ✅ Cloudflare Access: identity providers, email PIN, reusable groups
Where the encrypted connection ends ✅ On your host (WireGuard, Tailscale HTTPS, or Funnel TLS) ⚠️ At Cloudflare's edge, then a new hop down the tunnel
Raw TCP (databases, SSH) ✅ Any tailnet client, optional PROXY protocol ⚠️ Client runs cloudflared or the Cloudflare One client, or browser SSH/VNC
Viewers need an app installed ⚠️ Tailscale on each device, except for Funnel ✅ A browser is enough for HTTP
No app network wiring ✅ Proxies to the container IP, no ports, no extra network ⚠️ No ports, but each app joins cloudflare-net
What runs on the host ✅ One stateless container, plus tailscaled ⚠️ Master, Redis, socket proxy, cloudflared; a state volume to back up
Web UI ⚠️ None; the Tailscale admin console, optional DockTail Cloud ✅ Dashboard, manual rules for non-Docker targets, live logs, backups
Several Docker hosts ⚠️ One independent agent per host ✅ One master with agents (agent image marked beta)

DockFlare column based on the project's own documentation as of October 2026. If we got something wrong, tell us.

Which one

Pick by who needs to reach the app.

Choose DockFlare if

The audience is the internet, on your domain.

  • →The people using the app do not run Tailscale: family, clients, or a SaaS sending webhooks.
  • →You want app.yourdomain.com, path routing or wildcard hostnames.
  • →You want a Cloudflare Access login (identity provider or email PIN) in front of public apps, set from a label.
  • →You want one web UI over several hosts, including a few targets that are not Docker containers.

Choose DockTail if

The audience is you and your devices.

  • →The apps are for you and your devices: admin panels, the *arr stack, databases, dashboards.
  • →Nothing should reach the internet unless that container carries Funnel labels.
  • →You need raw TCP (Postgres, Redis, SSH) from any of your devices without a client-side tunnel command.
  • →You would rather not own a domain, move its DNS to Cloudflare, or run Redis and a state volume for this.

Or run both

Private by default, public where it has to be.

Plenty of homelabs need both jobs done. The two tools read different labels, so they share a host and even a container without stepping on each other. Put docktail.* labels on the apps you use yourself, and dockflare.* labels on the few containers that need a public hostname on your domain. If one of those sits on cloudflare-net and other networks, set docktail.service.network to choose which container IP DockTail uses.

Moving from DockFlare

For the apps that never needed to be public.

Admin UIs behind an Access login are the usual candidates. Keep DockFlare for anything that has to stay on your own domain: Funnel serves ts.net hostnames only.

  1. 1

    Run DockTail on the host: Tailscale on a tagged host (or a Tailscale sidecar), tags and auto-approvers in your tailnet policy, and an OAuth client with Services: Write and Devices Core: Write, all as in the DockTail docs.

  2. 2

    Translate the labels: dockflare.enable=true becomes docktail.service.enable=true, the port in dockflare.service=http://app:8080 becomes docktail.service.port=8080, and docktail.service.name sets the tailnet name. Your custom hostname does not carry over.

  3. 3

    Access Groups have no label equivalent. Who may reach the service is decided in your tailnet policy file; docktail.tags sets the service tags those rules match.

  4. 4

    Remove the dockflare.* labels. DockFlare deletes the ingress rule and DNS record once its grace period (GRACE_PERIOD_SECONDS, 600 by default) has passed.

  5. 5

    Detach the container from cloudflare-net if nothing else on it needs that network.

Questions

Questions about DockFlare and DockTail.

Is DockFlare a Tailscale alternative?
Not really. DockFlare publishes containers to the public internet through Cloudflare Tunnel and protects them with Cloudflare Access. Tailscale, and DockTail on top of it, keeps them on a private network that only your devices join. The overlap is the workflow: both turn Docker labels into a published service.
Is DockFlare still maintained?
Yes, as of October 2026. Version 3.1.6 was released on 20 September 2026, commits landed in October, and only a couple of issues were open. Most of the work comes from its original author.
Can I run DockFlare and DockTail together?
Yes. They read different labels (dockflare.* and docktail.*), so one container can carry both. A common split is DockTail on the apps you use yourself and DockFlare on the few containers that need a public hostname on your domain. If a container is attached to several networks, docktail.service.network picks the one DockTail uses for its IP.
DockFlare alternative without Cloudflare or a domain?
DockTail publishes containers on your tailnet with names under ts.net, so no domain or DNS provider is involved. For the parts that must be public, Tailscale Funnel works through DockTail with docktail.funnel.enable and docktail.funnel.port plus the funnel node attribute, on the machine's ts.net hostname and ports 443, 8443 or 10000. Other Tailscale-based tools give each container its own tailnet device; see DockTail vs TSDProxy.
Where does TLS end with DockFlare and with DockTail?
With DockFlare, Cloudflare terminates TLS at its edge and forwards the request to cloudflared through the tunnel. With DockTail, tailnet traffic is WireGuard-encrypted all the way to the host, whose Tailscale also terminates HTTPS with a Tailscale certificate when the service uses port 443. For Funnel, TLS ends on your node as well, and Tailscale's relay cannot decrypt it.
Does DockFlare need a Cloudflare domain?
Yes. Its prerequisites are a Cloudflare account, the zone ID of your domain and an API token that can write tunnels, Access applications and policies, and DNS. DockFlare then creates a CNAME to the tunnel for each hostname. Wildcard DNS records are the exception: you create those by hand.

DockFlare: GitHub · documentation

Other comparisons

DockTail next to the other tools.

All comparisons →

DockTail (the agent)

Getting Docker containers onto a tailnet, or onto the internet.

DockTail Cloud (monitoring)

Knowing when those services break, and why.

Open source · AGPL-3.0

Start with one private app.

Pick an app only you need to reach, give it three docktail.* labels, and leave DockFlare in charge of the ones that face the internet.

Read the quick start GitHub