BCCLI over Tailscale
Tailscale gives you a private network path to a remote machine without opening a port to the internet. For running an agent somewhere else, that is usually the whole point: the machine stays unreachable from anywhere except your own devices.
1. Join the machine to your network
Install Tailscale on the remote machine and sign it in to the same network as your own devices. It now has a stable private address that only your tailnet can route to.
2. Reach its shell
Connect as you normally would — SSH over the Tailscale address, or a Tailscale-aware client. Once you have a shell on the machine, the rest is ordinary BCCLI:
bccli login
cd your-project && bccli3. Nothing else to attach
The current BCCLI v0.4 workflow does not depend on a separate attach command. You are running it on the machine, through a private path; there is no daemon to leave running and no session to rejoin from elsewhere.
Why this over a public port
A model runtime or an agent session exposed on a public interface is only as safe as its own authentication, which is usually none. With Tailscale, the network layer is the gate: if a device is not in your tailnet, it cannot reach the port at all.
Next
- Remote security — the rest of the network posture.
- Remote BCCLI setup — installing and signing in on that machine.