What's weird about reading this post is that tailscale itself is over-engineered (at least on linux anyway).

I was shocked to find the number of netfilter rules in place, all of which made the normal linux routing table useless.

I think a lot of what they're doing is neat, but when you're trying to debug forwarding rules on a box running docker as well, it kind of becomes a nightmare.

Docker messes heavily with the forwarding tables as well. One or the other is fine, but mixing the two is kind of a nightmare to sort through.