Tailboot is a Debian live image that boots headless, joins your tailnet with an embedded auth key, and enables Tailscale SSH. It installs nothing else; add what you need over SSH.
1. Create an auth key
In Settings → Keys, choose Generate auth key:
| Description | tailboot (optional) |
|---|---|
| Reusable | On |
| Expiration | 90 days |
| Ephemeral | On |
| Pre-approved | On, if shown |
| Tags | An isolated tag such as tag:isolated |
Tagging is recommended. Define the tag in Access Controls and write your policy so tagged machines cannot reach other devices while you can still reach them over Tailscale SSH. The tag alone restricts nothing; broad allow rules must exclude it. See Set up servers.
Each boot registers a new ephemeral device. When the key expires, generate another and build a new ISO.
2. Create the ISO
Wi-Fi (optional)
WPA2/WPA3 Personal. Ethernet takes priority; Wi-Fi is the fallback. Leave the network name empty to use Ethernet only.
Base image: v2026.09.05.194107
Credentials are written into the ISO in your browser and are not uploaded. The resulting image contains them in plain text; keep it private.
3. Flash and boot
Write the ISO to a USB drive with dd, Etcher, or
similar and boot from it on a machine with Ethernet or the Wi-Fi
network you configured. No display or keyboard is needed. The
machine appears in your tailnet as tailboot; if that
name is taken, Tailscale appends a number (tailboot-1).
4. Connect
ssh tailboot@tailboot
sudo -i
Tailscale authenticates the session; there is no password. Your
policy must allow port 22 to the machine and include an SSH rule
for the tailboot user. autogroup:nonroot
covers it; root is not included. See
Tailscale SSH.
The local console logs in as tailboot automatically.
If it prompts, the password is live. The account has
passwordless sudo.
FAQ
Does the website send my auth key to a server?
No. The website is a static page on GitHub Pages. It has no backend. Your browser downloads the base ISO, writes your key into the ISO, and saves the file on your computer. The key does not leave your browser.
How does the browser change the ISO?
The base ISO has a file /TAILBOOT.JSON with a
reserved 4096-byte placeholder. Your browser reads the ISO as a
stream and replaces the placeholder at the byte offset recorded
during the release build with your settings as JSON. The JSON is
padded with spaces to the same size. Nothing
else in the ISO moves. The file is outside the compressed live
system, so the replacement does not damage the filesystem. See
tailboot-iso.ts.
How does the machine use the key?
At boot, a service reads /TAILBOOT.JSON from the boot
medium, extracts the key, and starts Tailscale with SSH enabled.
The service keeps the key only in memory. Each boot
registers a new ephemeral device. See
the boot scripts.
How can I check this?
All code is open source at
github.com/ShoeBoom/tailboot.
Open the network panel of your browser before you create an ISO.
You will see one request to the proxy for the base ISO and no
request that contains your key. Mount the ISO you made and read
TAILBOOT.JSON to see the data it contains.
Can I make the ISO without the website?
Not yet. A command-line tool is planned in issue #23.
Why must I restrict the key with a tag?
The ISO contains the key in plain text. A person who has the USB drive can read the key. Restrict the key to an isolated tag so a machine that boots the ISO cannot reach other devices in your tailnet.