I’ve seen this with a few GUI-based containers too. One thing worth trying is running them through a Tailscale sidecar/container or using a dedicated network namespace, rather than relying on the container’s own Tailscale integration. That way the app itself doesn’t need to support Tailscale networking directly. It might be worth checking the container’s network mode and whether it binds only to localhost as well.