juanfont/headscale · warning

unexpected end of container wait

Error message

unexpected end of container wait

What it means

Wrapped error from newLoginHTTPClient when newDebugJar() fails to construct the cookie jar used by the OIDC login HTTP client. The hostname prefix identifies which node's login flow failed. cookiejar.New essentially only fails on nil options misconfiguration, so in practice this is near-unreachable.

Source

Thrown at cmd/hi/docker.go:30

	"os/exec"
	"path/filepath"
	"strings"
	"time"

	"github.com/cenkalti/backoff/v5"
	"github.com/docker/docker/api/types/container"
	"github.com/docker/docker/api/types/image"
	"github.com/docker/docker/api/types/mount"
	"github.com/docker/docker/client"
	"github.com/docker/docker/pkg/stdcopy"
	"github.com/juanfont/headscale/integration/dockertestutil"
)

const defaultDirPerm = 0o755

var (
	ErrTestFailed              = errors.New("test failed")
	ErrUnexpectedContainerWait = errors.New("unexpected end of container wait")
	ErrNoDockerContext         = errors.New("no docker context found")
	ErrMemoryLimitViolations   = errors.New("container(s) exceeded memory limits")
)

// runTestContainer executes integration tests in a Docker container.
//
//nolint:gocyclo // complex test orchestration function
func runTestContainer(ctx context.Context, config *RunConfig) error {
	cli, err := createDockerClient(ctx)
	if err != nil {
		return fmt.Errorf("creating Docker client: %w", err)
	}
	defer cli.Close()

	runID := dockertestutil.GenerateRunID()
	containerName := "headscale-test-suite-" + runID
	logsDir := filepath.Join(config.LogsDir, runID)

View on GitHub (pinned to 565fd254d0)

Solutions

1. Treat as non-actionable if seen once; verify Go toolchain version matches the repo's pinned version (go.mod, nix develop).
2. Re-run the test to rule out transient runtime failure.

if err != nil {
    if strings.Contains(err.Error(), "creating cookiejar") {
        // non-actionable defensive failure; verify toolchain and retry once
    }
    return err
}

When it happens

Trigger: doLoginURL / OIDC login flow where cookiejar.New(nil) returns an error — only possible if the net/http cookiejar constructor rejects its options, which with nil options it does not in current Go.

Common situations: Essentially defensive coding; would only fire after a stdlib behavior change or a very unusual runtime corruption.

Related errors

• unknown --set value (want must|all)
• test pattern is required as first argument or use --test fla
• auth request rejected
• not confirmed, aborting
• tag must start with the string 'tag:'

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/3f1a37d15e67d3e8. Report an issue: GitHub.