Tailvisor gives macOS/Linux VMs their own Tailscale identity

Tailvisor is an open-source sandbox that runs macOS and Linux guest VMs via Apple's Virtualization.framework while routing all guest networking through a tsnet node on the host. The result: each VM shows up on your tailnet as its own device, with no Tailscale client installed inside the guest.

The architecture pairs a Swift layer (VM lifecycle, GUI, CLI) with a Go networking layer compiled as a C archive and linked into a single binary. The Go side handles ARP, DHCP, DNS, and ICMP, intercepts TCP through a gVisor userspace stack, and proxies both TCP and UDP through tsnet.Dial. All non-peer egress is forced through an auto-selected exit node on the VM's tailnet, and the host's own network stack is explicitly excluded as a fallback path.

For engineers, this offers a practical way to spin up isolated, identity-scoped VMs that are network-bound entirely to a tailnet — useful for testing, ephemeral dev environments, or sandboxing workloads without exposing the host network. Current limitations include Apple Silicon-only support (macOS 14+, arm64) and no IPv6 support yet.