- Run tailscaled with --netfilter-mode=off to avoid iptables failures in the container, which were breaking the MagicDNS proxy at 100.100.100.100 - Set dns: 100.100.100.100 so Docker forwards DNS queries to Tailscale's MagicDNS proxy instead of Contabo's public DNS, which was resolving ollama.lan.poldebra.me to the server's public IP instead of the tailnet IP