I still do not understand. You run tailguard in docker, so the host is surely capable of running tailscale. I must be missing something.

Yes, the docker container is running outside the network