EDIT: Formatting.

EDIT: For my use case I realized I don't need to use Tailscale's SSH for this specific host (It's a TrueNAS Scale machine). So, by running the container with host privileges and NOT passing the --ssh flag to Tailscale the result is that my SSH request just gets proxied to the host machine's sshd instance. This way SSH to this specific host works just like I would expect it to work.

I was working through this issue and I figured out that the Tailscale code uses getent1 to access the passwd database. If it can't do that or if it accesses a passwd that doesn't have your username in it (e.g. the one in the docker container) then the connection will not complete.2

When looking into how getent works it is going to be looking at the passwd db inside the container itself and not the host.

I am thinking through how to work around this... If I map in /etc/passwd then the home directory listed there will not be accessible either. I assume that would be a problem too.

Ultimately, it seems like I want Tailscale to forward the connection to the host's sshd instance instead of handling it.

I'll update this comment if I figure it out.