tailscale auth: use docker.sock privileged container (proven method)

.gitea/workflows/ts-probe.yml

@@ -7,7 +7,13 @@ jobs:
   auth:
     runs-on: host
     steps:
-      - name: Install nsenter and run tailscale auth
+      - name: Tailscale auth via privileged docker
         run: |
-          apt-get update -qq && apt-get install -y -qq util-linux 2>&1 | tail -3
-          echo 'IyEvYmluL2Jhc2gKc2V0IC1lCk5TPSJuc2VudGVyIC10IDEgLW0gLXUgLWkgLW4gLXAgLS0iCmVjaG8gIj09PSBLaWxsaW5nIGFueSBvbGQgdGFpbHNjYWxlIHVwID09PSIKJE5TIHBraWxsIC1mICJ0YWlsc2NhbGUgdXAiIDI+L2Rldi9udWxsIHx8IHRydWUKc2xlZXAgMgplY2hvICI9PT0gQ3VycmVudCB0YWlsc2NhbGUgc3RhdHVzID09PSIKJE5TIHRhaWxzY2FsZSBzdGF0dXMgMj4mMSB8fCB0cnVlCmVjaG8gIiIKZWNobyAiPT09IFJ1bm5pbmcgdGFpbHNjYWxlIHVwIC0tc3NoIC0tdGltZW91dCAyNDBzID09PSIKZWNobyAiUGxlYXNlIGNsaWNrIHRoZSBhdXRoIFVSTCB3aGVuIGl0IGFwcGVhcnMhIgokTlMgdGFpbHNjYWxlIHVwIC0tc3NoIC0tdGltZW91dCAyNDBzIDI+JjEgfHwgdHJ1ZQplY2hvICIiCmVjaG8gIj09PSBGaW5hbCBzdGF0dXMgPT09IgokTlMgdGFpbHNjYWxlIHN0YXR1cyAyPiYxIHx8IHRydWUKZWNobyAiPT09IERPTkUgPT09Igo=' | base64 -d | bash
+#!/bin/bash
+set -x
+# Start a privileged container with host PID/net namespace, install nsenter, run script
+docker run --rm --privileged --pid=host --net=host alpine:latest sh -c "
+  apk add --no-cache util-linux 2>&1 | tail -1
+  echo 'IyEvYmluL3NoCk5TPSJuc2VudGVyIC10IDEgLW0gLXUgLWkgLW4gLXAgLS0iCmVjaG8gIj09PSBDaGVja2luZyBob3N0ID09PSIKJE5TIGhvc3RuYW1lCiROUyBjYXQgL2V0Yy9vcy1yZWxlYXNlIHwgaGVhZCAtMwplY2hvICIiCmVjaG8gIj09PSBLaWxsaW5nIG9sZCB0YWlsc2NhbGUgdXAgPT09IgokTlMgcGtpbGwgLWYgInRhaWxzY2FsZSB1cCIgMj4vZGV2L251bGwgfHwgdHJ1ZQpzbGVlcCAyCmVjaG8gIj09PSB0YWlsc2NhbGVkIHN0YXR1cyA9PT0iCiROUyBzeXN0ZW1jdGwgaXMtYWN0aXZlIHRhaWxzY2FsZWQKZWNobyAiIgplY2hvICI9PT0gUnVubmluZyB0YWlsc2NhbGUgdXAgKDMwMHMgdGltZW91dCkgPT09IgokTlMgdGFpbHNjYWxlIHVwIC0tc3NoIC0tdGltZW91dCAzMDBzIDI+JjEgfHwgdHJ1ZQplY2hvICIiCmVjaG8gIj09PSBGaW5hbCBzdGF0dXMgPT09IgokTlMgdGFpbHNjYWxlIHN0YXR1cyAyPiYxIHx8IHRydWUKZWNobyAiPT09IERPTkUgPT09Igo=' | base64 -d | sh
+" 2>&1
+