Help: wyze-bridge in Docker w/ Tailscale gets IOTC_ER_TIMEOUT on macOS

Goal:
I'm trying to run docker-wyze-bridge to get my Wyze cameras into HomeKit. My setup involves running the bridge in a Docker container on a Mac, with a sidecar Tailscale container for remote access.

My Environment:

• Host: macOS
• Docker: Docker Desktop for Mac
• Router: Verizon Internet Gateway
• Cameras: Wyze Cam v3 and Wyze Cam v4

The Problem:
After a lot of troubleshooting, I have a stable setup where:

1. The tailscale container starts, gets a permanent IP address, and successfully accepts the route to my home LAN (192.168.1.0/24).
2. The wyze-bridge container starts, successfully logs into my Wyze account, and fetches the correct list of my cameras.

However, when wyze-bridge tries to connect to the cameras at their local IP addresses (e.g., 192.168.1.155), the connection fails with the error: [-13] IOTC_ER_TIMEOUT. This results in "preview not available" in the web UI.

Final docker-compose.yml Configuration:

This is the final configuration file we landed on, which solves the Tailscale persistence issues.

services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale-wyze-persistent
    hostname: wyze-bridge-final
    restart: unless-stopped
    environment:
      # This forces tailscale to save its state file in our persistent volume
      - TS_STATE_DIR=/var/lib/tailscale
      # This tells the container to accept the route to my home network.
      - TS_EXTRA_ARGS=--accept-routes
    volumes:
      - ./ts-state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add: [NET_ADMIN]

  wyze-bridge:
    image: mrlt8/wyze-bridge:latest
    container_name: wyze-bridge-final
    restart: unless-stopped
    network_mode: service:tailscale
    depends_on: [tailscale]
    environment:
      - WYZE_EMAIL=tylerronek@gmail.com
      - WYZE_PASSWORD='Josh#1125!'
      - API_ID=b5176d56-def5-4b0e-9b1a-36c4191020f7
      - API_KEY=IxzniPseXxP7ERSgr108H1bnO5CGYdocRX2b2ES0t4KUxLZKayLUDlUGXqRh
      - WB_IP=100.98.139.85 # Stable Tailscale IP
      - WB_USERNAME=admin
      - WB_PASSWORD=password

Troubleshooting Steps Taken:
I've confirmed the following:

✅ Wyze Credentials: The email, password, and API keys are correct, as proven by the fact that wyze-bridge successfully fetches the camera list from the Wyze API.

✅ Tailscale Persistence: The container now keeps the same IP address (100.98.139.85) after restarts (docker-compose down && up).

✅ Subnet Routing (Host): The native Tailscale client on my Mac is running and successfully advertising the 192.168.1.0/24 route.

✅ Subnet Routing (Container): The Docker container is successfully accepting the route (confirmed in the logs).

✅ macOS Firewall: The firewall on my Mac is completely disabled.

✅ Router Firewall: The Verizon router's firewall is set to "Low Security" (the lowest setting), and "AP/Client Isolation" is disabled. DNS Rebind protection is also disabled.

✅ Camera Status: The cameras are online and viewable in the native Wyze mobile app.

Even with all of this correctly configured, the connection from the container to the camera's local IP still times out. This seems to be a very specific networking issue between Docker for Mac, Tailscale's network_mode, and the local LAN.