tailscale/tailcat
Tailcat test: create an account-free WireGuard connection token
After skipping three completed Trending projects, we selected #4 Tailcat, built its v0.2.0 CLI, passed 11 non-privileged test groups, and generated and parsed a real connection token.
01 · PROBLEM
What I wanted to solve
Tailcat promises a netcat-like encrypted tunnel without a Tailscale account or changes to system routes and DNS. The experiment needed to separate what could be verified in a restricted single container from claims that require two real devices and routable networks.
02 · PROCESS
What I did
The first official install attempt failed because Go was absent. We downloaded the official Go 1.26.5 archive, verified its published SHA-256, built the CLI, ran the full test suite, then reran 11 test groups that did not require privileged netlink access. We also generated a server token using a custom DERP hostname and parsed it with a new client key.
03 · RESULT
What actually happened
The CLI built successfully as v0.2.0. Eleven selected test groups passed. The generated token contained the expected server public key and custom DERP hostname. The full suite retained six integration failures caused by blocked netlink route access and automatic DERP probing in the container.
04 · PITFALLS
What others should watch for
This run did not prove end-to-end byte transfer between two physical devices, NAT traversal, public DERP reliability, throughput, or latency. Private keys remained in the isolated workspace and were excluded from every public artifact.
05 · VERDICT
My conclusion
Tailcat's build, token format, parsing path, and non-privileged core logic are verified. A final two-device test on unrestricted networks is still required before claiming that the complete connection path works in practice.