juanfont/headscale · error

writing TLS certificate to container: %w

Error message

writing TLS certificate to container: %w

What it means

Returned by the DERP integration-test helper when writing a CA certificate (user-<i>.crt under caCertRoot) into the running DERPer container fails via the container exec helper WriteFile. It wraps the copy/exec error.

Source

Thrown at integration/dsic/dsic.go:268

		dockertestutil.DockerAllowNetworkAdministration,
	)
	if err != nil {
		return nil, fmt.Errorf(
			"%s starting tailscale DERPer container (version: %s): %w",
			hostname,
			version,
			err,
		)
	}

	log.Printf("Created %s container\n", hostname)

	dsic.container = container

	for i, cert := range dsic.caCerts {
		err = dsic.WriteFile(fmt.Sprintf("%s/user-%d.crt", caCertRoot, i), cert)
		if err != nil {
			return nil, fmt.Errorf("writing TLS certificate to container: %w", err)
		}
	}

	if len(dsic.tlsCert) != 0 {
		err = dsic.WriteFile(fmt.Sprintf("%s/%s.crt", DERPerCertRoot, dsic.hostname), dsic.tlsCert)
		if err != nil {
			return nil, fmt.Errorf("writing TLS certificate to container: %w", err)
		}
	}

	if len(dsic.tlsKey) != 0 {
		err = dsic.WriteFile(fmt.Sprintf("%s/%s.key", DERPerCertRoot, dsic.hostname), dsic.tlsKey)
		if err != nil {
			return nil, fmt.Errorf("writing TLS key to container: %w", err)
		}
	}

	return dsic, nil

View on GitHub (pinned to 565fd254d0)

Solutions

1. Inspect the DERPer container logs (SaveLog output under control_logs) to see if it crashed right after start
2. Pin/verify the tailscale DERPer image version matches what the test expects
3. Re-run once to rule out transient Docker exec failures

When it happens

Trigger: After the DERPer container starts, dsic writes each extra CA cert into it; failure occurs if the target directory does not exist in the container, the exec fails, or the container exited between start and write.

Common situations: DERPer container crashes immediately on startup (bad flags/version mismatch), image layout changed between tailscale versions so /usr/local/share/ca-certificates is absent, or Docker exec errors under load.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• creating certificates for derp test: %w
• writing TLS key to container: %w
• %s starting tailscale DERPer container (version: %s): %w
• DERPer is not ready: %w
• writing TLS key to container: %w

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/1bffb070100377e8. Report an issue: GitHub.