I have solved this problem! The trick is to use two Docker containers:

1. Gluetun (https://github.com/qdm12/gluetun): set this up to connect to your VPN.
2. Tailscale (https://tailscale.com/kb/1282/docker/): set this to use the Gluetun network.

Here is an example docker-compose.yml:

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    # line above must be uncommented to allow external containers to connect.
    # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/connect-a-container-to-gluetun.md#external-container-to-gluetun
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./gluetun:/gluetun
    environment:
      - VPN_SERVICE_PROVIDER=airvpn
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=xxx
      - WIREGUARD_PRESHARED_KEY=xxx
      - WIREGUARD_ADDRESSES=xxx
      - WIREGUARD_MTU=1320
      - SERVER_COUNTRIES=United States
      # See https://github.com/qdm12/gluetun-wiki/tree/main/setup#setup
      # Timezone for accurate log times
      - TZ=America/New_York
      # Server list updater
      # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
      - UPDATER_PERIOD=24h

  tailscale:
    container_name: tailscale
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - ./tailscale/var/lib:/var/lib
      - ./tailscale/state:/state
      - /dev/net/tun:/dev/net/tun
    network_mode: "service:gluetun"
    restart: unless-stopped
    environment:
      - TS_HOSTNAME=airvpn-exit-node
      - TS_AUTHKEY=xxxxxxxx
      - TS_EXTRA_ARGS=--login-server=https://example.com --advertise-exit-node
      - TS_NO_LOGS_NO_SUPPORT=true
      - TS_STATE_DIR=/state
    image: tailscale/tailscale

Fair point, but that probably wouldn’t be a “big difference” for a first time user.

!selfhost@lemmy.ml

(put an “!” in front)

This seems to be a general theme. Those arguing loudest for better privacy are really saying “only we should be allowed to invade your privacy”. See: Google, Apple, the EU

I don’t see Cryptomator in the comparison. Doesn’t it have a similar feature set?

Consider the Remarkable 2. It is a little Linux computer that allows root access by SSH. It’s moddable, can markup pdfs, and is pleasant to write on. If you get one, just get the bare tablet from the manufacturer. Get a folio and pen from Amazon for way cheaper. Also, you can get $50 off with a referral code from someone who already has one.

It’s too bad Android didn’t lean more into it’s relative freedom. Instead, almost all Android manufacturers have followed Apple’s lead closely. I have to believe there’d be a sizeable market for a flagship Android phone with, say, a removable battery, headphone jack, SD card slot, and an easily unlocked bootloader.