Looks interesting, I see you've added a light React UI and a simple REST API on the Go service to query for status and control the Tailscale interface. I'll make a note for sure!

I myself didn't really have a need to disable the interface during the lifecycle of the container, so I went with the standard containerboot process provided by Tailscale. I also wanted the container to be "invisible" and not respond to any incoming connections, so that it feels like you're running Tailscale on the actual router.

Keeping things a bit more granular and flexible for this use case makes total sense.