# Install tailscale with Homebrew, apk, chocolatey, dnf, MacPorts, Nix, pacman, scoop, winget, zypper Easiest, most secure way to use WireGuard and 2FA. Version 1.98.8 via Homebrew; verified 2026-06-30. ## Install ```sh sudo av install brew:tailscale ``` ## Agent safety answer tailscale controls private network connectivity and identity-bound device access. - **Credential access:** Reads auth state, device identity, and network configuration. - **Remote mutation:** Can change connectivity, serve routes, and expose local services. - **Publish/artifact risk:** Can make internal services reachable through a tailnet. - **Recommended control:** Gate up, serve, funnel, exit-node, and auth-key operations. - **Agent-use guidance:** Allow status checks; require approval before changing network exposure or authentication. Additional install commands: ### macOS - Homebrew (100%): ```sh brew install tailscale ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install tailscale ``` Evidence: MacPorts ports tree: net/tailscale/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add tailscale ``` Evidence: Alpine Linux edge package indexes: tailscale from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - dnf (92%): ```sh sudo dnf install tailscale ``` Evidence: Fedora Rawhide package metadata: tailscale from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#tailscale ``` Evidence: nixpkgs package indexes: pkgs/by-name/ta/tailscale/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S tailscale ``` Evidence: Arch Linux sync databases: tailscale from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install tailscale ``` Evidence: openSUSE Tumbleweed package metadata: tailscale from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Chocolatey (92%): ```sh choco install tailscale ``` Evidence: Chocolatey community package catalog: tailscale from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','superputty' - Scoop (92%): ```sh scoop install extras/tailscale ``` Evidence: Scoop official bucket manifest trees: bucket/tailscale.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id Tailscale.Tailscale -e ``` Evidence: Windows Package Manager source index: Tailscale.Tailscale from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:tailscale - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.98.8 - **Source summary:** Easiest, most secure way to use WireGuard and 2FA - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-3-Clause - **Source archive:** - **Last updated:** 2026-06-30T16:05:57Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - tailscale (cli) - tailscaled (cli) - tailscale (alias) - tailscaled (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Service: declared - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.98.8 - Package-manager updated: 2026-06-30 - Local data: ok - Upstream repository: https://github.com/tailscale/tailscale - info: No cached GitHub release or tag data was available. ## Project history and usage Tailscale is a WireGuard-based, identity-aware mesh networking system with a prominent open source CLI and daemon. For package-manager users, it is both a networking product and a system package that installs `tailscale` and `tailscaled` onto developer laptops, servers, NAS devices, containers, and CI runners. ### Project history The public GitHub repository was created in January 2020. The README says it contains most of Tailscale's open source code, notably the `tailscaled` daemon and the `tailscale` CLI, while platform GUI wrappers live elsewhere or are not always open source. Official docs describe Tailscale as a Zero Trust identity-based connectivity platform that creates encrypted point-to-point connections using WireGuard and forms a peer-to-peer mesh network called a tailnet. ### Adoption history Tailscale adoption spread through official packages and platform clients rather than only source builds. The repository README points users to pkgs.tailscale.com for distro and platform packages, and the input package facts list Homebrew, MacPorts, Nix, Arch, Alpine, Fedora, openSUSE, Chocolatey, Scoop, WinGet, and others. That broad packaging footprint reflects its common role as developer infrastructure for SSH, subnet routing, exit nodes, remote access, and service-to-service connectivity. ### How it is used On Unix-like systems, package users usually install the daemon and CLI, authenticate the node, then use `tailscale` commands to bring the node up, inspect status, route traffic, configure SSH or Serve/Funnel features, and debug connectivity. The daemon stores node state locally unless configured for memory-only ephemeral state. ### Why package nerds care Package nerds care about Tailscale because it turns VPN setup into an installable system service with a scriptable CLI. It also makes packaging details matter: daemon state paths, systemd or launchd integration, kernel versus userspace networking, distro packages, Homebrew service behavior, and reproducible binaries all affect whether a node can join and stay healthy in a tailnet. ### Timeline - 2020: Public GitHub repository created. - 2020: Repository README identifies `tailscaled` and `tailscale` as the main open source daemon and CLI. - 2022: Official changelog introduced Tailscale SSH beta. - 2022: Official changelog documented ACL tags reaching general availability. - 2026: GitHub metadata shows a large open source repository with tens of thousands of stars and thousands of forks. ### Related projects - Tailscale relates to WireGuard, DERP relay servers, SSH, zero-trust networking, subnet routing, exit nodes, MagicDNS, Headscale, distro service packaging, and OS package managers. ### Sources - - - - - - source_facts.package-manager ## Security Notes formula declares a Homebrew service. - **Geiger risk:** orange / medium - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Credential files - Unix: /Library/Tailscale/tailscaled.state, ~/.local/share/tailscale/tailscaled.state, /opt/homebrew/var/lib/tailscale/tailscaled.state, /usr/local/var/lib/tailscale/tailscaled.state, $XDG_DATA_HOME/tailscale/tailscaled.state ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** tailscale - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Nix - tailscale: normalized package name match | nixpkgs package indexes: pkgs/by-name/ta/tailscale/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - tailscale - 1.98.5-r0: normalized package name match | Alpine Linux edge package indexes: tailscale from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The easiest, most secure way to use WireGuard and 2FA | https://tailscale.com/ - apk - tailscale-bash-completion - 1.98.5-r0: normalized package name match | Alpine Linux edge package indexes: tailscale-bash-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Bash completions for tailscale | https://tailscale.com/ - apk - tailscale-doc - 1.98.5-r0: normalized package name match | Alpine Linux edge package indexes: tailscale-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The easiest, most secure way to use WireGuard and 2FA (documentation) | https://tailscale.com/ - apk - tailscale-fish-completion - 1.98.5-r0: normalized package name match | Alpine Linux edge package indexes: tailscale-fish-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Fish completions for tailscale | https://tailscale.com/ - apk - tailscale-openrc - 1.98.5-r0: normalized package name match | Alpine Linux edge package indexes: tailscale-openrc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The easiest, most secure way to use WireGuard and 2FA (OpenRC init scripts) | https://tailscale.com/ - apk - tailscale-systemd - 1.98.5-r0: normalized package name match | Alpine Linux edge package indexes: tailscale-systemd from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | The easiest, most secure way to use WireGuard and 2FA (systemd files) | https://tailscale.com/ - apk - tailscale-zsh-completion - 1.98.5-r0: normalized package name match | Alpine Linux edge package indexes: tailscale-zsh-completion from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Zsh completions for tailscale | https://tailscale.com/ - dnf - tailscale - 1.98.4-1.fc45: normalized package name match | Fedora Rawhide package metadata: tailscale from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | The easiest, most secure way to use WireGuard and 2FA | https://github.com/tailscale/tailscale - pacman - tailscale - 1.98.4-1: normalized package name match | Arch Linux sync databases: tailscale from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | A mesh VPN that makes it easy to connect your devices, wherever they are. | https://tailscale.com - zypper - tailscale - 1.98.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: tailscale from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | The easiest, most secure way to use WireGuard and 2FA | https://github.com/tailscale/tailscale - zypper - tailscale-bash-completion - 1.98.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: tailscale-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Tailscale bash completion | https://github.com/tailscale/tailscale - zypper - tailscale-fish-completion - 1.98.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: tailscale-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Tailscale fish completion | https://github.com/tailscale/tailscale - zypper - tailscale-zsh-completion - 1.98.4-1.1: normalized package name match | openSUSE Tumbleweed package metadata: tailscale-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Tailsacle zsh completion | https://github.com/tailscale/tailscale - MacPorts - tailscale: normalized package name match | MacPorts ports tree: net/tailscale/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Chocolatey - tailscale: normalized package name match | Chocolatey community package catalog: tailscale from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','superputty' ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [boringtun](https://www.automicvault.com/pkg/brew/boringtun/) - Shares av.db curated category or tags: cli, networking, vpn, wireguard. - [headscale-cli](https://www.automicvault.com/pkg/brew/headscale-cli/) - Shares av.db curated category or tags: cli, networking, vpn, wireguard. - [nebula](https://www.automicvault.com/pkg/brew/nebula/) - Shares av.db curated category or tags: cli, mesh-networking, networking, vpn. - [wgcf](https://www.automicvault.com/pkg/brew/wgcf/) - Shares av.db curated category or tags: cli, networking, vpn, wireguard. - [wireguard-go](https://www.automicvault.com/pkg/brew/wireguard-go/) - Shares av.db curated category or tags: cli, networking, vpn, wireguard. - [wireguard-tools](https://www.automicvault.com/pkg/brew/wireguard-tools/) - Shares av.db curated category or tags: cli, networking, vpn, wireguard. - [dsvpn](https://www.automicvault.com/pkg/brew/dsvpn/) - Shares av.db curated category or tags: cli, networking, vpn. - [edgevpn](https://www.automicvault.com/pkg/brew/edgevpn/) - Shares av.db curated category or tags: cli, networking, vpn. ## Combined YAML source View the package source record on GitHub. [combined/tailscale.yml](https://github.com/automic-vault/db/blob/main/combined/tailscale.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph - curated agent safety answer