I have solved this problem! The trick is to use two Docker containers:

1. Gluetun (https://github.com/qdm12/gluetun): set this up to connect to your VPN.
2. Tailscale (https://tailscale.com/kb/1282/docker/): set this to use the Gluetun network.

Here is an example docker-compose.yml:

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    # line above must be uncommented to allow external containers to connect.
    # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/connect-a-container-to-gluetun.md#external-container-to-gluetun
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./gluetun:/gluetun
    environment:
      - VPN_SERVICE_PROVIDER=airvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=xxx
      - WIREGUARD_PRESHARED_KEY=xxx
      - WIREGUARD_ADDRESSES=xxx
      - WIREGUARD_MTU=1320
      - SERVER_COUNTRIES=United States
      # See https://github.com/qdm12/gluetun-wiki/tree/main/setup#setup
      # Timezone for accurate log times
      - TZ=America/New_York
      # Server list updater
      # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
      - UPDATER_PERIOD=24h

  tailscale:
    container_name: tailscale
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - ./tailscale/var/lib:/var/lib
      - ./tailscale/state:/state
      - /dev/net/tun:/dev/net/tun
    network_mode: "service:gluetun"
    restart: unless-stopped
    environment:
      - TS_HOSTNAME=airvpn-exit-node
      - TS_AUTHKEY=xxxxxxxx
      - TS_EXTRA_ARGS=--login-server=https://example.com --advertise-exit-node
      - TS_NO_LOGS_NO_SUPPORT=true
      - TS_STATE_DIR=/state
    image: tailscale/tailscale

This seems to be a general theme. Those arguing loudest for better privacy are really saying “only we should be allowed to invade your privacy”. See: Google, Apple, the EU

Yeah, but $5m sounds kind of low. That’ll buy, what, 10 homes?

They don’t exist. Believe me, since I finally put my old LG V20 out to pasture, I’ve been waiting. The closest thing is the Fairphone, but it doesn’t support all US LTE bands.

It’s too bad Android didn’t lean more into it’s relative freedom. Instead, almost all Android manufacturers have followed Apple’s lead closely. I have to believe there’d be a sizeable market for a flagship Android phone with, say, a removable battery, headphone jack, SD card slot, and an easily unlocked bootloader.

I agree with you strongly. We have the technology, it’s just pointed at the wrong crowd. The eyes of the surveillance state should be on the rich and powerful, not the masses. The price of power should be the loss of privacy.

I don’t know if that’ll help. Most cars are internet-connected nowadays. They can just stream the data back home.

My (often unpopular) opinion is: none. Our government agencies should exert their efforts improving privacy and security rather than subverting it. We should be a nation of white hat hackers.