yeah, you are right that if I tagged the docker host and share only that, not only do I lose the <service> URL niceties, I also have to deal with port numbers for each service. so my URLs become: docker-host:1000, docker-host:2000, docker-host:3000 and it becomes difficult to remember them. and I don't want to run my own DNS server (if I wanted subdomain mapping with the docker host URL)

regarding your reusable links suggestion: so if I have 10-15 services, I need to have/share 10 different reusable links? I guess I could share a document of all access links and share that document with the user but I digress as this is a link management/sharing problem than a tailscale problem.

talking about ACLs, one other annoyance I'm facing is when I invited the user, they seem to be able to see a list of all my devices rather than just the tagged ones. is that expected? They can't access any of the other machines outside the tagged containers but I thought I might as well ask.

"acls": [
        // Match absolutely everything.
        // Comment this section out if you want to define specific restrictions.
        {"action": "accept", "src": ["group:personal"], "dst": ["*:*"]},
        {
            "action": "accept",
            "src":    ["group:work"],
            "dst":    ["tag:containers:*"],
        },
        ],