The key mistake in this September 2025 thread was interpreting modprobe tun failure as proof that ZimaOS had no TUN support at all. Zima-Jerry corrected that assumption: in the source build, TUN was compiled directly into the kernel, so there was no separate tun.ko file under /lib/modules for modprobe to load.
However, the user's specific Docker subnet-router workflow still needed the device/module behavior expected by Tailscale. IceWhale therefore changed the packaging in ZimaOS 1.5.0 so TUN became a loadable kernel module. The original poster retested on September 29 and replied that it was now working.
The User Wanted a Site-to-Site Tailscale Subnet Router
The source design connected two physical locations, Mexico and Uruguay, and wanted local devices at each site to communicate through Tailscale without installing Tailscale on every endpoint.
That is a subnet-router use case, not merely “remote access to the ZimaOS dashboard.” A subnet router must forward packets between the tailnet and another IP subnet.
modprobe Reported No tun Module File
The user ran a privileged Tailscale container and saw:
modprobe: FATAL: Module tun not found in directory /lib/modules/6.12.25They also found no tun.ko file and saw no TUN entry in the output of module-listing checks.
IceWhale Said TUN Was Compiled Directly into the Kernel
Zima-Jerry's first official reply was explicit: the TUN functionality was built directly into the kernel, so it would not appear as a normal module file in /lib/modules/6.12.25.
This is a Linux kernel distinction: a feature configured as built-in is present without appearing in lsmod or being loadable by modprobe.
Built-In Support Did Not Fully Solve the Source Container Workflow
The original poster replied that their container still dropped into userspace mode and could not provide the full host-style subnet-router behavior they wanted. They specifically asked whether TUN could be exposed in a modular way.
Zima-Jerry said this could be adjusted in the next version.
ZimaOS 1.5.0 Changed TUN to a Loadable Module
On September 28, Zima-Jerry posted that in the new 1.5.0 release, tun.ko had become a kernel module and asked the user to retest.
The original poster replied the next day: “Thanks, now it’s working.”
That is a source-confirmed fix and the most important conclusion of the thread.
Tailscale Userspace Networking Is a Different Operating Mode
Current Tailscale documentation explains that containers can run without a TUN device by using userspace networking. In that mode, tailscaled acts through a userspace network stack/proxy instead of behaving like a normal Linux tunnel interface.
Use Tailscale's current userspace networking model when deciding whether kernel TUN is actually required.
Current Tailscale Can Route Subnets in Kernel or Userspace Mode
Tailscale's current documentation now describes both kernel-mode and userspace/netstack subnet routing. Kernel mode on Linux preserves normal packet forwarding behavior and generally offers better performance; userspace mode can also route but terminates and re-originates supported traffic in its own network stack.
For Docker, current Tailscale also documents that TS_USERSPACE is enabled by default, while kernel mode requires /dev/net/tun and the required capabilities.
A Working TUN Device Is Not the Whole Subnet-Router Configuration
A Linux subnet router also needs IP forwarding, advertised routes, route approval in the Tailscale admin console, and appropriate tailnet access rules. A container successfully creating tailscale0 does not by itself mean remote LAN devices can route through it.
Follow the current Tailscale subnet-router workflow after the ZimaOS kernel/device layer is working.
Do Not Apply the 1.4.x “Missing tun.ko” Diagnosis to Current ZimaOS
The source itself documents the version boundary: the file was absent because of how the 1.4.x kernel was built, and ZimaOS 1.5.0 changed the TUN feature to a module. Current ZimaOS has moved well beyond that release.
For a modern failure, inspect the current container settings, TUN device availability, userspace/kernel mode, IP forwarding, and route approval rather than assuming the 2025 kernel packaging problem returned.
Tailscale TUN FAQ
Did modprobe tun failing prove ZimaOS had no TUN support?
No. IceWhale said TUN was compiled directly into the source kernel rather than shipped as a separate module.
What changed in ZimaOS 1.5.0?
Zima-Jerry said tun.ko became a loadable kernel module.
Did the original poster confirm the new version worked?
Yes. They retested after the 1.5.0 change and said it was working.
