Tailscale uses wireshark, which is peer-to-peer. Their "free" plan allows you to set up a network using their "coordination" server, which simplifies administration of your tailnet.
You control dns, exit nodes, etc, so tailscale isn't involved with the vpn itself, hence no speed limits.
You ultimately determine what tailscale collects as far as client logging.
If you block client logging, Tailscale may not be able to provide technical support.
I imagine the docker image serves to eliminate tailscale from the equation.
ETA: there are quite a few ad-blocking dns servers.
