That’s it! If you don’t specify a host path, i.e. the path before the colon, Docker will create an volume which saves any changes you make to that path in the container, but won’t mount any existing path from the host to the container.

Yes, I think that’s it. Their website really don’t make it easy to figure out…

/c/titlegore

You would need to set up routes on these other devices to tell them that VPN devices can be reached through the Pi. It’s possible, but I’ve never done it myself, so I don’t have any useful pointers.

Yes. All devices connected to the VPN will have a private IP inside the virtual network. You can use these to communicate as though they were public IPs, except that they can’t be used from outside the VPN.

Yes, you can connect the device behind CGNAT to your existing VPN as a client. Then, from inside the VPN, you would use the its virtual address to connect to it. You can use a systemd service or similar to have the VPN connect at boot.

Tailscale and Netmaker use wireguard under the hood, so as long as you manage to establish the connections, they should be just as fast! If you need to use relaying, however, that will introduce additional overhead.

I’ve tried from networks outside my home and I can access the server from there. Looking at a traceroute, I stop getting anything somewhere between my ISP and the datacenter the server is in.

I do this, too. I haven’t tried Tailscale, but Netmaker wasn’t able to deal with my CGNAT without a relay node, and I found that to be hit-and-miss.