im not doing any of that today either. really need to get back to hacking so i can share
I quickly checked your notes and the tailscale docs. to run the docker container you need at least those --cap-add=net_admin and --device /dev/net/tun, neither of those can be done at the moment afaik.