🐞 Bug: Traefik - container app-traefik continuously restarting

[kommandantredundant]

Bug Description

I am running the compose stack on a Ugreen UGOS NAS (not sure if thats relevant). The container app-traefik keeps restarting in a loop while tailscale and simpleweb are running. There are no logs at all. in the UGOS interface all i can see is the container stopping with exit code 1. SSHing into my nas and trying to fetch logs via CLI I get nothing.

As the tailscale container is running without any errors, i can see the app registering in the tailscale admin console, but it leads nowhere.

Expected Behavior

the container should spin up so I can access the app.

Actual Behavior

continuous startup loop

Screenshots

No response

Operating System

Linux

Tailscale Version

1.98.4

Docker Version

26.1.0

Relevant Logs or Error Messages

Docker Compose Configuration

configs:
  ts-serve:
    content: |
      {"TCP":{"443":{"HTTPS":true}},
      "Web":{"$${TS_CERT_DOMAIN}:443":
          {"Handlers":{"/":
          {"Proxy":"http://127.0.0.1:80"}}}},
      "AllowFunnel":{"$${TS_CERT_DOMAIN}:443":false}}

services:
# Make sure you have updated/checked the .env file with the correct variables. 
# All the ${ xx } need to be defined there.
  # Tailscale Sidecar Configuration
  tailscale:
    image: tailscale/tailscale:latest # Image to be used
    container_name: tailscale-${SERVICE} # Name for local container management
    hostname: ${SERVICE} # Name used within your Tailscale environment
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json # Tailscale Serve configuration to expose the web interface on your local Tailnet - remove this line if not required
      - TS_USERSPACE=false
      - TS_ENABLE_HEALTH_CHECK=true              # Enable healthcheck endpoint: "/healthz"
      - TS_LOCAL_ADDR_PORT=127.0.0.1:41234       # The <addr>:<port> for the healthz endpoint
      - TS_ACCEPT_DNS=true # Uncomment when using MagicDNS
      - TS_AUTH_ONCE=true
    configs:
      - source: ts-serve
        target: /config/serve.json
    volumes:
      - ./config:/config # Config folder used to store Tailscale files - you may need to change the path
      - ./ts/state:/var/lib/tailscale # Tailscale requirement - you may need to change the path
    devices:
      - /dev/net/tun:/dev/net/tun # Network configuration for Tailscale to work
    cap_add:
      - net_admin # Tailscale requirement
    ports:
      - 0.0.0.0:${SERVICEPORT}:${SERVICEPORT} # Binding port ${SERVICE}PORT to the local network - may be removed if only exposure to your Tailnet is required
    # If any DNS issues arise, use your preferred DNS provider by uncommenting the config below
    # dns: 
    #   - ${DNS_SERVER}
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:41234/healthz"] # Check Tailscale has a Tailnet IP and is operational
      interval: 1m # How often to perform the check
      timeout: 10s # Time to wait for the check to succeed
      retries: 3 # Number of retries before marking as unhealthy
      start_period: 10s # Time to wait before starting health checks
    restart: always

  # ${SERVICE}
  traefik_proxy:
    image: ${IMAGE_URL} # Image to be used
    network_mode: service:tailscale # Sidecar configuration to route ${SERVICE} through Tailscale
    container_name: app-${SERVICE} # Name for local container management
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ}
    depends_on:
      tailscale:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "pgrep", "-f", "${SERVICE}"] # Check if ${SERVICE} process is running
      interval: 1m # How often to perform the check
      timeout: 10s # Time to wait for the check to succeed
      retries: 3 # Number of retries before marking as unhealthy
      start_period: 30s # Time to wait before starting health checks
    restart: always
    volumes:
      - type: bind
        source: ./${SERVICE}-data/app/traefik.yml
        target: /etc/traefik.yml
      - ./${SERVICE}-data/log/:/var/log/
      - /var/run/docker.sock:/var/run/docker.sock #Required for the Service Connections
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.ssl.address=:443"
      - --log.level=INFO
      - --log.filepath=/var/log/traefik.log
      - --accesslog=true
      - --accesslog.filepath=/var/log/traefik.access.log
      - --experimental.plugins.traefik-plugin-geoblock.modulename=github.com/nscuro/traefik-plugin-geoblock
      - --experimental.plugins.traefik-plugin-geoblock.version=v0.14.0
    labels:
      - traefik.enable=true
      - traefik.http.routers.mydashboard.rule=Host(`traefik.domain.local`)
      - traefik.http.routers.mydashboard.service=api@internal

  simpleweb:
    image: yeasy/simple-web:latest
    labels:
      - traefik.enable=true # To 
      - traefik.http.routers.simpleweb.rule=Host(`simpleweb.domain.local`)
      - traefik.http.routers.simpleweb.entrypoints=web

Environment Configuration (.env file)

#version=1.1
#URL=https://github.com/tailscale-dev/ScaleTail
#COMPOSE_PROJECT_NAME= # Optional: only use when running multiple deployments on the same infrastructure.

# Service Configuration
SERVICE=traefik
IMAGE_URL=traefik:latest

# Network Configuration
SERVICEPORT=80
DNS_SERVER=1.1.1.1

# Tailscale Configuration
TS_AUTHKEY=tskey-auth-xxx

# Time Zone setting for containers 
TZ=Europe/Berlin # See: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

# Optional Service variables
# PUID=1000

#EXAMPLE_VAR="Environment varibale"

Additional Context

No response

[jackspiering]

@kommandantredundant after the container is in a restart loop, could you please share the output of the following command: docker inspect --format "{{json .State.Health}}" app-traefik | jq

And also id.

Thanks.