juanfont/headscale · critical

%s could not start tailscale container (version: %s): %w Do

Error message

%s could not start tailscale container (version: %s): %w

Docker build failed. Last %d lines of output:
%s

What it means

The tailscale HEAD container could not be started, and the diagnostic rebuild of the image also failed — so this error carries the original start failure plus the last 100 lines of Docker build output. It is the terminal, most-informative error of the container bring-up path: the build log tells you why the image cannot be produced.

Source

Thrown at integration/tsic/tsic.go:512

				log.Printf("Docker build failed for %s, attempting to get detailed output...", hostname)

				buildOutput, buildErr := dockertestutil.RunDockerBuildForDiagnostics(dockerContextPath, "Dockerfile.tailscale-HEAD")

				// Show the last 100 lines of build output to avoid overwhelming the logs
				lines := strings.Split(buildOutput, "\n")

				const maxLines = 100

				startLine := 0
				if len(lines) > maxLines {
					startLine = len(lines) - maxLines
				}

				relevantOutput := strings.Join(lines[startLine:], "\n")

				if buildErr != nil {
					// The diagnostic build also failed - this is the real error
					return nil, fmt.Errorf(
						"%s could not start tailscale container (version: %s): %w\n\nDocker build failed. Last %d lines of output:\n%s",
						hostname,
						version,
						err,
						maxLines,
						relevantOutput,
					)
				}

				if buildOutput != "" {
					// Build succeeded on retry but container creation still failed
					return nil, fmt.Errorf(
						"%s could not start tailscale container (version: %s): %w\n\nDocker build succeeded on retry, but container creation failed. Last %d lines of build output:\n%s",
						hostname,
						version,
						err,
						maxLines,
						relevantOutput,

View on GitHub (pinned to 565fd254d0)

Solutions

1. Read the appended build output — the failing RUN/step is in the last 100 lines.
2. Reproduce manually: `docker build -f Dockerfile.tailscale-HEAD <context>` to iterate faster.
3. Avoid the build path entirely by setting HEADSCALE_INTEGRATION_TAILSCALE_IMAGE to a working prebuilt image.
4. If a base image disappeared upstream, rebuild/pin the base in the Dockerfile.

When it happens

Trigger: tsic builds `Dockerfile.tailscale-HEAD` (no prebuilt image, not CI-enforced), the build fails (base image gone, network fetch failure inside build, Dockerfile drift vs current tailscale source), and the retry/diagnostic build also fails.

Common situations: Building tailscale HEAD against a moved upstream dependency; build-context path changes; offline environment; Docker BuildKit version incompatibility with the Dockerfile.

Related errors

• %s failed to fetch tailscale status: %w
• no network set, called from: %s
• running pre-built tailscale container %q: %w
• creating tailscale node: %w
• %s sending confirm request: %w

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/aa6248d0c95d7643. Report an issue: GitHub.