Trying to decide between Nebula and Tailscale for your infrastructure?
+const bodyContent = `Trying to decide between Headscale, Nebula, and Tailscale for your infrastructure?
-Tailscale, Nebula, and ZeroTier are the three most popular overlay networks, and all three are genuinely good at what they were built for: giving machines a flat, encrypted network regardless of where they physically sit. But "machines on a flat network" and "AI agents that find and trust each other" are different problems. This article compares the architecture of Tailscale, Nebula, and ZeroTier head to head, then explains where an agent-native overlay like Pilot Protocol fits — and, just as importantly, where it does not. The goal is an honest decision guide, not a teardown.
+Tailscale, Nebula, and ZeroTier are the three most popular overlay networks, and all three are genuinely good at what they were built for: giving machines a flat, encrypted network regardless of where they physically sit. Headscale — the open-source, self-hosted reimplementation of the Tailscale control server — is the fourth option on most shortlists, and it changes the calculus for teams that want the Tailscale client experience without the hosted control plane. But "machines on a flat network" and "AI agents that find and trust each other" are different problems. This article compares the architecture of Headscale, Tailscale, Nebula, and ZeroTier head to head, then explains where an agent-native overlay like Pilot Protocol fits — and, just as importantly, where it does not. The goal is an honest decision guide, not a teardown.
Trying to decide between Nebula and Tailscale for your i
It is the easiest of the three to adopt, and for connecting laptops, servers, and CI runners into one private network it is hard to beat. The trade-offs: the coordination server is a hosted dependency (the open-source Headscale re-implements it if you need self-hosting), identity is tied to human accounts and devices, and the model is "give this machine an IP," not "let this agent advertise a capability."
Headscale is an open-source reimplementation of the Tailscale control server. The Tailscale client on each machine still speaks WireGuard for the data plane, but instead of talking to Tailscale's hosted coordination service, clients register against a Headscale server you run yourself. You get the familiar tailscale up experience, MagicDNS-style naming, and ACLs — with the membership logic, key distribution, and coordination state living on infrastructure you control.
What Headscale is not is a separate protocol or a different client. It is a compatible control-plane implementation: the wire protocol between client and control server is the same one Tailscale clients already speak. That is precisely its appeal — teams adopt Headscale to remove the hosted dependency from their Tailscale deployment without changing anything on the endpoint. The trade-offs mirror Tailscale's: identity is tied to devices and (depending on your setup) human accounts, discovery is a coordination server rather than a directory of capabilities, and the abstraction remains the host and its IP. There is no notion of an agent, a capability, or a per-message trust decision.
+If you are choosing between the hosted control plane and Headscale, the question is one of operational ownership, not capability: do you want Tailscale to run the coordination layer, or do you want to run it yourself? (For the agent-native version of that question — per-peer trust and capability discovery instead of network membership — see why autonomous agents need private discovery.)
+Nebula came out of Slack and is built around a certificate authority you run yourself. You issue each host a signed certificate that encodes its IP and group membership; firewall rules are expressed in terms of those groups. Discovery and NAT traversal go through lighthouses — well-known nodes that track where everyone is and help peers punch through NAT. The data plane uses the Noise protocol framework over UDP.
@@ -67,9 +74,30 @@ const bodyContent = `Trying to decide between Nebula and Tailscale for your i
Neither answers a question that matters once your "hosts" are autonomous AI agents rather than laptops and servers: how does an agent find another agent it has never talked to, and how does it decide whether to trust a specific peer rather than an entire network? That's the gap Pilot Protocol closes, described next.
Headscale and Nebula are the two most common answers when a team decides it wants a self-hosted mesh and asks: "Do we keep the Tailscale client experience, or run a fully independent stack?" Both remove the hosted dependency from the control path, but they get there differently — Headscale by reimplementing an existing control protocol, Nebula by shipping its own complete network stack.
+| Headscale | Nebula | |
|---|---|---|
| What it is | Self-hosted reimplementation of the Tailscale control server | Standalone overlay network with its own client, CA, and lighthouses |
| Client | The standard Tailscale client (no changes on endpoints) | Nebula's own agent, installed per host |
| Data plane | WireGuard | Noise protocol framework over UDP |
| Identity model | Tailscale-style device auth against your control server | Signed certificates you issue per host from your own CA |
| Discovery | Coordination server (yours) | Lighthouses you run |
| Operational ownership | You run the control server; endpoint behavior stays Tailscale | You own the CA, cert rotation, and lighthouses |
| Best fit | Teams that want the Tailscale experience with no hosted control plane | Server fleets that want a self-contained stack with no dependency on the Tailscale protocol |
The practical difference is compatibility versus independence. Headscale keeps you on the Tailscale client and its ecosystem — your endpoints behave exactly as they would with the hosted service, which is the point. Nebula asks you to adopt its client and run a certificate authority, but in exchange nothing in your stack references Tailscale's protocol at all. Both are legitimate, well-maintained, self-hosted choices; the decision is about whether you want to stay inside the Tailscale ecosystem or run a protocol of your own.
+What neither provides is an agent layer. Both are built around hosts, IPs, and network membership — there is no notion of a discoverable capability, a per-peer trust handshake, or a durable address that follows an agent across machines and clouds. That is the layer Pilot Protocol occupies, described next.
+Pilot does not try to be a better VPN. It operates one layer up. The questions an agent actually asks are: "What is my durable address? How do I discover an agent that can do X? How do I prove who I am and decide whether to trust this peer — per connection, not per network?" A VPN answers none of these; it just delivers packets once you already know the IP. (For a broader look at why agents need their own networking layer, see why AI agents need their own network stack.)
+Pilot does not try to be a better VPN. It operates one layer up. The questions an agent actually asks are: "What is my durable address? How do I discover an agent that can do X? How do I prove who I am and decide whether to trust this peer — per connection, not per network?" A VPN answers none of these; it just delivers packets once you already know the IP. (For a broader look at why agents need their own networking layer, see why AI agents need their own network stack, or start with the plain-language primer on what Pilot Protocol is.)
Trying to decide between Nebula and Tailscale for your i