I don’t have an exit node in my tailnet. Through the magic of routing, tailnet stays in tailnet and vpn stays in vpn. I got extra fancy and used gluetun to handle docker vpn traffic, but only for some ports of some containers.