tsexec routes commands through Tailscale without root by using pasta to create network namespaces via user namespaces. It spawns two processes: the parent runs Tailscale in the host namespace, the child runs in the network namespace with traffic routed through the parent. Built for self-hosted GitHub Actions runners that need Tailnet access without full root Tailscale installs. Unlike userspace networking mode, this supports all protocols (UDP, ICMP) without requiring tools to support SOCKS/HTTP proxies. Usage: `tsexec -auth-key tskey-auth-xxx ping my-server`