Tailscale

The cloud is convenient until it isn't. You upload your photos, sync your contacts, click through the cookie banners. Then prices go up again or you read about a family that lost their entire Google account over a medical photo sent to a doctor. At some point, the question shifts from "why would I run this myself?" to "why aren't I?" My guest this week is Alex Kretzschmar, head of DevRel at Tailscale, longtime host of the Self-Hosted podcast, and co-founder of Linuxserver.io. We cover what self-hosting really means in 2026, the apps worth running yourself like Immich and Home Assistant, why Docker Compose ties it all together, and how Tailscale lets you reach any of it from anywhere, without opening a single port. If you've been thinking about pulling your digital life back behind your own walls, this is your roadmap. Episode sponsors Temporal Talk Python Courses Links from the show Guest Alex Kretzschmar: alex.ktz.me Bitflip podcast: bitflip.show Self-Hosted podcast (Alex's previous show): selfhosted.show Perfect Media Server: perfectmediaserver.com KTZ Systems on YouTube: youtube.com/@ktzsystems Linuxserver.io (co-founded by Alex): linuxserver.io "How Tailscale Works" blog post: tailscale.com/blog/how-tailscale-works https://tailscale.com/: tailscale.com Self-hosted apps discussed Awesome Self-Hosted (GitHub list): github.com Immich (Google Photos alternative): immich.app Home Assistant: home-assistant.io Open Home Foundation: openhomefoundation.org Plausible Analytics: plausible.io Umami Analytics: umami.is Python integration for umami: pypi.org Pi-hole: pi-hole.net AdGuard Home: adguard.com NextDNS: nextdns.io Coolify: coolify.io Docker + ufw: docs.docker.com Storage, backup & filesystem OpenZFS: openzfs.org ZFS.rent (offsite ZFS replication): zfs.rent Backblaze: backblaze.com Hetzner Storage Box: hetzner.com DigitalOcean: digitalocean.com Secrets management mentioned OpenBao (open-source Vault fork): openbao.org HashiCorp Vault: hashicorp.com Bitwarden: bitwarden.com 1Password: 1password.com Hardware mentioned Proxmox VE: proxmox.com Minisforum MS01: minisforum.com Zima Board / Zima OS: zimaspace.com Other references Cory Doctorow on "enshittification" (Cory's blog where he coined the term): pluralistic.net Linus Tech Tips' WAN Show (Linus mentioned NAS-building going mainstream): linustechtips.com Watch this episode on YouTube: youtube.com Episode #546 deep-dive: talkpython.fm/546 Episode transcripts: talkpython.fm Theme Song: Developer Rap 🥁 Served in a Flask 🎸: talkpython.fm/flasksong ---== Don't be a stranger ==--- YouTube: youtube.com/@talkpython Bluesky: @talkpython.fm Mastodon: @talkpython@fosstodon.org X.com: @talkpython Michael on Bluesky: @mkennedy.codes Michael on Mastodon: @mkennedy@fosstodon.org Michael on X.com: @mkennedy

Alex Kretzschmar

Engineer

TailscaleLinuxServer.io

Adam talks with Tailscale co-founder and Chief Strategy Officer David Carney about where Tailscale is headed next: TSIDP, TSNet, multiple tailnets, and Aperture. They get into clickless auth (via TSIDP), TSNet apps, multiple tailnets for isolation and control, and Aperture, Tailscale’s private AI gateway for API key management, observability, and agent security. Join the discussion Changelog++ members save 8 minutes on this episode because they made the ads disappear. Join today! Sponsors: Augment Code – Adam loves “Auggie” – Augment Code’s CLI that brings Augment’s context engine and powerful AI reasoning anywhere your code goes. From building alongside you in the terminal to any part of your development workflow. NordLayer – Toggle-ready network security for modern businesses. Get an exclusive offer: up to 22% off NordLayer yearly plans plus 10% on top with the coupon code changelog-10-NORDLAYER. Try it risk-free with a 14-day money-back guarantee at nordlayer.com/thechangelog Squarespace – Turn your expertise into a business with the all-in-one platform for websites, services, and getting paid. Use code CHANGELOG to save 10% on your first website purchase. Fly.io – The home of Changelog.com — Deploy your apps close to your users — global Anycast load-balancing, zero-configuration private networking, hardware isolation, and instant WireGuard VPN connections. Push-button deployments that scale to thousands of instances. Check out the speedrun to get started in minutes. Featuring: David Carney – Website, GitHub, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Send an email to David ~> aperture@tailscale.com Mentioned in this episode Tailscale Aperture by Tailscale TSIDP TSNet Multiple tailnets Tailnet policy file syntax Model Context Protocol (MCP) MCP specification Proxmox VE Incus OIDC / OpenID Connect OAuth 2.0 Okta Microsoft Entra ID Google Workspace Keycloak Salesforce Anthropic Amazon Bedrock Oso Cerbos Go GopherCon Simon Willison Something missing or broken? PRs welcome!

David Carney

Co-founder and Chief Strategy Officer

Tailscale

Corey Quinn sits down with Avery Pennarun, co-founder and CEO of Tailscale, for a deep dive into how the company is reinventing networking for the modern era. From finally making VPNs behave the way they should to tackling AI security with zero-click authentication, Avery shares candid insights on building infrastructure people actually love using, and love talking about. They get into everything: surviving 100% year-over-year growth, why running on two tailnets at once is pure chaos, and how Tailscale makes “secure by default” feel effortless. Plus, they dig into why FreeBSD firewalls needed some tough love, the uncomfortable truth behind POCs, and even the surprisingly useful trick of turning your Apple TV into an exit node. About Avery:  Avery Pennarun is the co-founder and CEO of Tailscale, where he’s redefining secure networking with a simple, Zero Trust approach. A veteran software engineer with experience ranging from startups to Google, he’s known for turning complex systems into approachable, user-friendly tools. His contributions to projects like wvdial, bup, and sshuttle reflect his belief that great technology should be both powerful and easy to use. With a mix of technical depth and dry humor, Avery shares insights on modern networking, internet evolution, and the realities of scaling a startup. Highlights: (0:00) Introduction to Tailscale and Security (00:52) Sponsorship and Personal Experiences (02:07) Technical Deep Dive into Tail Scale (06:10) Challenges and Future of Tail Scale (22:45) Building the Tail Net's API (23:54) Connecting Cloud Providers with Tailscale (25:22) Tailscale as a Security Solution (26:44) Innovations and Future of Tailscale Sponsored by: duckbillhq.com

Avery Pennarun

CEO

Tailscale

Alex Kretzschmar joins Adam for a trip down the Linux rabbit hole – Docker vs Podman, building a Kubernetes cluster, ZFS backups with zfs.rent, bootc, favorite Linux distros, new homelab tools built with AI, self-hosting Immich, content creation, Plex and Jellyfin, the future of piracy and more. Join the discussion Changelog++ members save 10 minutes on this episode because they made the ads disappear. Join today! Sponsors: Tiger Data – Postgres for Developers, devices, and agents The data platform trusted by hundreds of thousands from IoT to Web3 to AI and more. Depot – 10x faster builds? Yes please. Build faster. Waste less time. Accelerate Docker image builds, and GitHub Actions workflows. Easily integrate with your existing CI provider and dev workflows to save hours of build time. Augment Code – Adam loves “Auggie” – Augment Code’s CLI that brings Augment’s context engine and powerful AI reasoning anywhere your code goes. From building alongside you in the terminal to any part of your development workflow. Framer – Design and publish in one place. Get started free at framer.com/design, code CHANGELOG for a free month of Pro. Featuring: Alex Kretzschmar – Website, GitHub, LinkedIn, Mastodon, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Tailscale YouTube Docker Podman Kubernetes zfs.rent bootc Immich Plex Jellyfin Something missing or broken? PRs welcome!

Alex Kretzschmar

Engineer

TailscaleLinuxServer.io

Today’s show: Jason, Alex, and Lon break down today’s top tech and startup stories — from Slate Auto’s customizable $25K EV truck to Discord’s major leadership shakeup ahead of a potential IPO. They also cover Uber’s self-driving push with Volkswagen, Perplexity AI’s aggressive growth moves, and why value-driven products are winning in a tough economy. Plus, Alex sits down with Tailscale CEO Avery Pennarun to unpack how they grew from 5K to 10K customers — and why fixing internet networking could spark the next huge wave of innovation. * Timestamps: (0:00) Jason, Lon and Alex kick off the show! (3:26) Introduction and features of Bezos-backed EV truck company, Slate (7:55) Market impact and value proposition of Slate's EV trucks (9:48) LinkedIn Ads - Get a $100 LinkedIn ad credit at http://www.linkedin.com/thisweekinstartups (14:04) EV features and market potential discussion (17:42) Discord CEO steps down and IPO prospects (20:19) Lemon.io - Get 15% off your first 4 weeks of developer time at https://Lemon.io/twist (24:00) Uber and Volkswagen's self-driving car partnership (28:39) Superpower - The best founders know: better health = better business. Visit http://superpower.com/twist to skip the waitlist. (30:00) Pace of self-driving car adoption and regulation (37:20) Butterfly Effect secures Benchmark investment (38:37) Perplexity and Motorola Razr partnership (43:12) Jason's experience with Light Phone (45:39) New York Times and Ziff Davis lawsuits against OpenAI (50:09) Nonprofit structures and OpenAI's mission issues (54:01) Founder Friday: Pitchfire and TACTUN's two-year plans (1:02:28) Introduction to Tailscale and Avery Pennarun (1:10:17) Tailscale's enterprise adoption (1:21:13) Current Internet networking issues* Subscribe to the TWiST500 newsletter: https://ticker.thisweekinstartups.com Check out the TWIST500: https://www.twist500.com Subscribe to This Week in Startups on Apple: https://rb.gy/v19fcp * Links from episode: Check out Tailscale: https://tailscale.com/ Check out Slate vehicles: https://www.slate.auto/en Check out Not For Private Gain:https://notforprivategain.org/ Check out the Light Phone: https://www.thelightphone.com/ Check out Oregon lawmakers article: ****https://www.oregonlive.com/politics/2025/04/oregon-lawmakers-to-decide-whether-big-tech-should-pay-to-support-local-journalism.html Check out Manus: https://manus.im/ * Follow Lon: X: https://x.com/lons * Follow Alex: X: https://x.com/alex LinkedIn: ⁠https://www.linkedin.com/in/alexwilhelm * Follow Jason: X: https://twitter.com/Jason LinkedIn: https://www.linkedin.com/in/jasoncalacanis * Thank you to our partners: (9:48) LinkedIn Ads - Get a $100 LinkedIn ad credit at http://www.linkedin.com/thisweekinstartups(20:19) Lemon.io - Get 15% off your first 4 weeks of developer time at https://Lemon.io/twist(28:39) Superpower - The best founders know: better health = better business. Visit http://superpower.com/twist to skip the waitlist. * Great TWIST interviews: Will Guidara, Eoghan McCabe, Steve Huffman, Brian Chesky, Bob Moesta, Aaron Levie, Sophia Amoruso, Reid Hoffman, Frank Slootman, Billy McFarland * Check out Jason’s suite of newsletters: https://substack.com/@calacanis * Follow TWiST: Twitter: https://twitter.com/TWiStartups YouTube: https://www.youtube.com/thisweekin Instagram: https://www.instagram.com/thisweekinstartups TikTok: https://www.tiktok.com/@thisweekinstartups Substack: https://twistartups.substack.com * Subscribe to the Founder University Podcast: https://www.youtube.com/@founderuniversity1916

Avery Pennarun

CEO

Tailscale

Maya Kaczorowski noticed that AI identity and AI agent identity concerns were emerging from outside the security industry, rather than from CISOs and security leaders. She concluded that OAuth, the open standard for authentication, already serves the purpose of granting access without exposing passwords.  Kaczorowski, a respected technologist and founder of Oblique, a startup focused on self-serve access controls, recently wrote about OAuth and AI agents and shared her insights on this episode of The New Stack Makers. She noted that developers see AI agents as extensions of themselves, granting them limited access to data and capabilities—precisely what OAuth is designed to handle.  The challenges with AI agent identity are vast, involving different approaches to authentication, such as those explored by companies like AuthZed. While existing authorization models like RBAC or ABAC may still apply, the real challenge lies in scale. The exponential growth of AI-related entities—from users to LLMs—could mean even small organizations manage hundreds of thousands of agents. Future solutions must accommodate this massive scale efficiently.  For the full discussion, check out The New Stack Makers interview with Kaczorowski.  Learn more from The New Stack about OAuth requirements for AI Agents:  OAuth 2.0: A Standard in Name Only?  AI Agents Are Redefining the Future of Identity and Access Management Join our community of newsletter subscribers to stay on top of the news and at the top of your game.

Maya Kaczorowski

Chief Product Officer

Google CloudTailscaleOBOblique

For the past year, David Crawshaw has intentionally sought ways to use LLMs while programming, in order to learn about them. He now regularly use LLMs while working and considers their benefits a net-positive on his productivity. David wrote down his experience, which we found both practical and insightful. Hopefully you will too! Join the discussion Changelog++ members get a bonus 11 minutes at the end of this episode and zero ads. Join today! Sponsors: Retool – The low-code platform for developers to build internal tools — Some of the best teams out there trust Retool…Brex, Coinbase, Plaid, Doordash, LegalGenius, Amazon, Allbirds, Peloton, and so many more – the developers at these teams trust Retool as the platform to build their internal tools. Try it free at retool.com/changelog Augment Code – Developer AI that uses deep understanding of your large codebase and how you build software to deliver personalized code suggestions and insights. Augment provides relevant, contextualized code right in your IDE or Slack. It transforms scattered knowledge into code or answers, eliminating time spent searching docs or interrupting teammates. Temporal – Build invincible applications. Manage failures, network outages, flaky endpoints, long-running processes and more, ensuring your workflows never fail. Register for Replay in London, March 3-5 to break free from the status quo. Featuring: David Crawshaw – Website, GitHub, Bluesky, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X Show Notes: How I program with LLMs sketch.dev merde.ai: ai-fixed merge conflicts How Tailscale’s free plan stays free Something missing or broken? PRs welcome!

David Crawshaw

Software Engineer

Tailscale

We take you one last time back to the All Things Open 2024 hallway track to talk with some friends, new & old. We speak with Alex Kretzchmar about self-hosting. We speak with Israa Taha about self-confidence. We speak with Avindra Fernando & Adhithi Ravichandran about self-employment. Join the discussion Changelog++ members save 12 minutes on this episode because they made the ads disappear. Join today! Sponsors: Sentry – Code breaks, fix it faster. Don’t just observe. Take action. Sentry is the only app monitoring platform built for developers that gets to the root cause for every issue. 100,000+ growing teams use sentry to find problems fast. Use the code CHANGELOG when you sign up to get $100 OFF the team plan. Coder.com – Instantly launch fully configured cloud development environments (CDE) and make your first commit in minutes. No need to traverse README files or await onboarding queues. Learn more at Coder.com Eight Sleep – Take your sleep and recovery to the next level. Go to eightsleep.com/changelog and use the code CHANGELOG to get $350 off your very own Pod 4 Ultra. You can try it for free for 30 days - but we’re confident you will not want to return it. Once you experience AI-optimized sleep, you’ll wonder how you ever slept without it. Currently shipping to: United States, Canada, United Kingdom, Europe, and Australia. AssemblyAI – Turn voice data into summaries with AssemblyAI’s leading Speech AI models. Built by AI experts, their Speech AI models include accurate speech-to-text for voice data (such as calls, virtual meetings, and podcasts), speaker detection, sentiment analysis, chapter detection, PII redaction, and more. Featuring: Alex Kretzschmar – Website, GitHub, LinkedIn, Mastodon, X Israa Taha – Website, GitHub, LinkedIn, X Avindra Fernando – Website, LinkedIn, X Adhithi Ravichandran – Website, GitHub, LinkedIn, X Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: Self-hosted media server goodness (Changelog & Friends #44) Self-Hosted Show Nix & NixOS Self-Hosted 133: No Google October Perplexica is an AI-powered search engine Foo Camp - Wikipedia BarCamp - Wikipedia Something missing or broken? PRs welcome!

Alex Kretzschmar

Engineer

TailscaleLinuxServer.io

Avindra Fernando

Freelance Software Engineer

Adhithi Ravichandran

Freelance Developer & Educator

Alex Kretzschmar joins Adam to discuss their experiences with building the “perfect media server” and all the hardware and software involved to make it happen — LinuxServer.io, PerfectMediaServer.com, Plex, Jellyfin, ZFS, mergerfs, TrueNAS, Docker Compose and so much more in this episode. Join the discussion Changelog++ members get a bonus 5 minutes at the end of this episode and zero ads. Join today! Sponsors: Sentry – Code breaks, fix it faster. Don’t just observe. Take action. Sentry is the only app monitoring platform built for developers that gets to the root cause for every issue. 90,000+ growing teams use sentry to find problems fast. Use the code CHANGELOG when you sign up to get $100 OFF the team plan. Tailscale – Adam loves Tailscale! Tailscale is programmable networking software that’s private and secure by default. It’s the easiest way to connect devices and services to each other, wherever they are. Secure, remote access to production, databases, servers, kubernetes, and more. Try Tailscale for free for up to 100 devices and 3 users at changelog.com/tailscale, no credit card required. Also check out Remotely access Home Assistant via Tailscale for free! Coda – Your all-in-one collaborative workspace. Coda brings teams and tools together for a more organized work day. Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs. Featuring: Alex Kretzschmar – Website, GitHub, LinkedIn, Mastodon, X Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X Show Notes: blog.ktz.me linuxserver.io perfectmediaserver.com ZFS is resource efficient. selfhosted.show The Best Media Server CPU… in the world. A Cheap No-Frills OPNsense box mergerfs The beginning of linuxserver.io jimsalterjrs/sanoid Jellyfin Plex Restic Auto-Restic Something missing or broken? PRs welcome!

Alex Kretzschmar

Engineer

TailscaleLinuxServer.io

This episode of Screaming in the Cloud features Katie Reese, an experienced events producer at Tailscale, who walks us through the ins and outs of event marketing within the tech industry. Katie shares insights on effective swag management and event planning to create memorable experiences that drive product adoption. Additionally, Katie and Corey discuss the challenges and strategies of marketing in a post-pandemic, budget-conscious world and explore how remote-first companies have adapted to these changes. Show Highlights:  00:00 - Intro 00:19 - Welcome Katie Reese, discussing life in sunny Mexico City and her work at Tailscale 03:03 - How Tailscale's product-led growth feels like magic 05:08 - Success stories from the Tailscale Up conference 06:25 - Event strategies in the post-pandemic, budget-conscious era 09:04 - The benefits of remote-first companies and changes in the event landscape 10:36 - Katie's career journey and the value of networking at events 14:34 - The thoughtful approach to swag and reducing event waste 20:14 - How bad marketing can ruin customer interactions 25:40 - Ensuring swag runs out at the right time at conferences 28:10 - Discussion on ethical event practices and avoiding waste 32:04 - Closing thoughts and where to find Katie online About Katie: Katie leads field events at Tailscale and, when she is not traveling, splits her time between small-town Tennessee and Mexico City because it's all about balance. Links referenced:  *Tailscale: https://tailscale.com/ *Katie's LinkedIn: https://www.linkedin.com/in/katie-reese/ *Katie’s Twitter: https://twitter.com/katiereese317?lang=en Sponsor *Panoptica Academy: https://panoptica.app/lastweekinaws

Katie Reese

Events Producer

Tailscale

Maya Kaczorowski, Chief Product Officer at Tailscale, joins Corey on Screaming in the Cloud to discuss what sets the Tailscale product approach apart, for users of their free tier all the way to enterprise. Maya shares insight on how she evaluates feature requests, and how Tailscale’s unique architecture sets them apart from competitors. Maya and Corey discuss the importance of transparency when building trust in security, as well as Tailscale’s approach to new feature roll-outs and change management. About Maya Maya is the Chief Product Officer at Tailscale, providing secure networking for the long tail. She was mostly recently at GitHub in software supply chain security, and previously at Google working on container security, encryption at rest and encryption key management. Prior to Google, she was an Engagement Manager at McKinsey & Company, working in IT security for large enterprises. Maya completed her Master's in mathematics focusing on cryptography and game theory. She is bilingual in English and French. Outside of work, Maya is passionate about ice cream, puzzling, running, and reading nonfiction. Links Referenced: Tailscale: https://tailscale.com/ Tailscale features:VS Code extension: https://marketplace.visualstudio.com/items?itemName=tailscale.vscode-tailscale  Tailscale SSH: https://tailscale.com/kb/1193/tailscale-ssh  Tailnet lock: https://tailscale.com/kb/1226/tailnet-lock  Auto updates: https://tailscale.com/kb/1067/update#auto-updates  ACL tests: https://tailscale.com/kb/1018/acls#tests  Kubernetes operator: https://tailscale.com/kb/1236/kubernetes-operator  Log streaming: https://tailscale.com/kb/1255/log-streaming  Tailscale Security Bulletins: https://tailscale.com/security-bulletins  Blog post “How Our Free Plan Stays Free:” https://tailscale.com/blog/free-plan  Tailscale on AWS Marketplace: https://aws.amazon.com/marketplace/pp/prodview-nd5zazsgvu6e6

Maya Kaczorowski

Chief Product Officer

Google CloudTailscaleOBOblique

About Avery wvdial, bup, sshuttle, netselect, popularity-contest, redo, gfblip, GFiber, and now @Tailscale doing WireGuard mesh. Top search result for "epic treatise." Links Referenced: Webpage: https://tailscale.com Tailscale Twitter: https://twitter.com/tailscale Personal Twitter: https://twitter.com/apenwarr

Avery Pennarun

CEO

Tailscale

Alex comes up with better ways to interact with technology and writes about it on his website.  Is there a link between playing music and writing code? A previous article of ours covered the merger of the two in the music programming language, Sonic PI.  If you're curious about the weird extremes of operating system development, check out TempleOS.  Cassidy and Alex both take copious notes through Obsidian. Alex has a plugin that may help you organize notes automatically.    See Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.

Alex Kretzschmar

Engineer

TailscaleLinuxServer.io

On this week's Kubernetes Podcast, your hosts talk to Maya Kaczorowski from Google Cloud about Kubernetes security, and look at announcements from Microsoft, Docker, Cisco and Spotify. Do you have something cool to share? Some questions? Let us know: web: kubernetespodcast.com mail: kubernetespodcast@google.com twitter: @kubernetespod News of the week Microsoft Azure Kubernetes Service goes GA IBM launch multi-zone clusters Dockercon: Federated application management Extending Kubernetes to Windows Server with Docker Enterprise Edition Design applications in Docker Desktop Cisco Live announcement on CCP, Kuberenetes, and Cloud partnership How Spotify is migrating from an in-house Docker orchestration platform to Kubernetes Links from the interview Kromtech article on cryptojacking Security scanning tools: Clair MicroScanner Kubernetes secrets Use an KMS provider for data protection Hashicorp Vault and Kubernetes Cluster hardening guides: GKE Security Overview GKE cluster hardening Kubernetes.io docs on cluster security Exploring Container Security blog series Overview by Maya Kaczorowski Node and container operating systemes by Aditya Kal and Dan Lorenc Digging into Grafeas container image metadata by Felix Glaser and Wendy Dembowski Protecting and defending your Kubernetes Engine network, by Manjot Pahwa, Ahmet Alp Balkan and Bowei Du Running a tight ship with Kubernetes Engine 1.10 by Aaron Small and Vic Iglesias Using Cloud Security Command Center (and five partner tools) to detect and manage an attack by Maya Kaczorowski and Andy Chang Isolation at different layers of the Kubernetes stack by Tim Allclair and Maya Kaczorowski @MayaKaczorowski on Twitter

Maya Kaczorowski

Chief Product Officer

Google CloudTailscaleOBOblique