mc/metacircular
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix incident report: Tailscale was disabled deliberately

Browse Source 
MagicDNS routed all DNS through broken MCNS, making external services
(Claude, Gitea) unreachable. Disabling Tailscale was the correct
action to restore external DNS, not a mistake.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kyle Isom
2026-04-03 09:25:49 -07:00
parent a474f17a8b
commit 5aceb496e8
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
log/2026-04-03-uid-incident.md
View File

@@ -76,9 +76,13 @@ DNS config pointed to MCNS. Tailscale itself remained functional
(its coordination servers are external), but hostname resolution via (its coordination servers are external), but hostname resolution via
Tailscale DNS names failed. Tailscale DNS names failed.
The operator turned off Tailscale on vade (the workstation) thinking The operator turned off Tailscale on vade (the workstation) because
Tailscale was the problem. This broke connectivity to rift entirely Tailscale's MagicDNS was routing ALL DNS queries through the broken
since the MCP agent binds to the Tailnet IP only (`100.95.252.120:9444`). MCNS resolver — external services including Claude Code and Gitea
were unreachable. Disabling Tailscale was the only way to restore
external DNS resolution. However, this also broke connectivity to
rift since the MCP agent binds to the Tailnet IP only
(`100.95.252.120:9444`).
### Recovery ### Recovery
@@ -205,9 +209,11 @@ ownership changes.
was no tool to translate a service definition into a `podman run` was no tool to translate a service definition into a `podman run`
command without the full MCP deploy pipeline. command without the full MCP deploy pipeline.
6. **Tailscale is not the problem when DNS breaks.** Tailscale's 6. **Tailscale MagicDNS amplifies DNS failures.** When MCNS is down
control plane is external. Turning off Tailscale makes things worse, and MagicDNS routes through it, ALL DNS breaks — not just internal
not better, because the agents bind to Tailnet IPs. names. Disabling Tailscale restores external DNS but loses Tailnet
connectivity. The fix is fallback resolvers that bypass MCNS, not
disabling Tailscale.
## Action Items ## Action Items