{"record":{"id":"db4b992d074b2120","repo":"juanfont/headscale","slug":"writing-policy-w","errorCode":null,"errorMessage":"writing policy: %w","messagePattern":"writing policy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"integration/hsic/hsic.go","lineNumber":608,"sourceCode":"\t)\n\n\t// Write the CA certificates to the container\n\tfor i, cert := range hsic.caCerts {\n\t\terr = hsic.WriteFile(fmt.Sprintf(\"%s/user-%d.crt\", caCertRoot, i), cert)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"writing TLS certificate to container: %w\", err)\n\t\t}\n\t}\n\n\terr = hsic.WriteFile(\"/etc/headscale/config.yaml\", []byte(MinimumConfigYAML()))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"writing headscale config to container: %w\", err)\n\t}\n\n\tif hsic.aclPolicy != nil {\n\t\terr = hsic.writePolicy(hsic.aclPolicy)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"writing policy: %w\", err)\n\t\t}\n\t}\n\n\tif hsic.hasTLS() {\n\t\terr = hsic.WriteFile(tlsCertPath, hsic.tlsCert)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"writing TLS certificate to container: %w\", err)\n\t\t}\n\n\t\terr = hsic.WriteFile(tlsKeyPath, hsic.tlsKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"writing TLS key to container: %w\", err)\n\t\t}\n\t}\n\n\tfor _, f := range hsic.filesInContainer {\n\t\terr := hsic.WriteFile(f.path, f.contents)\n\t\tif err != nil {","sourceCodeStart":590,"sourceCodeEnd":626,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/integration/hsic/hsic.go#L590-L626","documentation":"Produced when hsic.writePolicy(hsic.aclPolicy) fails — only attempted when a policy option (WithACLPolicy) was supplied. The policy is serialized (HuJSON) and written to a file inside the container; failure means serialization of the policy to bytes or the in-container file write failed.","triggerScenarios":"Constructing HeadscaleInContainer with WithACLPolicy(...) where the *tailcfg.Policy or acl.Policy cannot be marshalled (unsupported field combination), or the in-container write fails as in errors 673/674.","commonSituations":"Test passing a policy struct with fields the serializer does not handle; container not writable; transient docker exec failure.","solutions":["Check the wrapped error: marshalling errors point at the policy struct; copy errors point at the container","Simplify the policy to a minimal valid one to isolate the offending field","Confirm the container is running and /etc/headscale writable","Compare with working policies in existing integration tests for the same format"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Lint the policy before passing it in\nif _, err := policyv2.CompilePolicy(aclPolicy); err != nil { t.Fatalf(\"invalid policy: %v\", err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate policy structs with the same serializer hsic uses before the run","Model new policies on existing integration tests to stay within supported fields","Confirm the container is writable when the error is a copy failure, not a marshal failure"],"tags":["integration-test","acl-policy","hujson","docker"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}