13.3.5: Keycloak does not start: Aspire.Hosting.DistributedApplicationException: One or more container network tunnel proxies did not start successfully: 'aspire-container-network-tunnelproxy'

[milanlugn]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I saw that #16897 and #17052 introduced fixes for Keycloak. however I still have issues on the latest Aspire versions. I'm currently running into the following error:

 Failed to create resource keycloak
Aspire.Hosting.DistributedApplicationException: One or more container network tunnel proxies did not start successfully: 'aspire-container-network-tunnelproxy': Container image for container network tunnel could not be built, or its presence could not be verified: failed to build client proxy image: docker command 'BuildImage' returned with non-zero exit code 125
error
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
error
            Install the buildx component to build images with BuildKit:
error
            https://docs.docker.com/go/buildx/
error
unknown flag: --progress
error
Usage:  docker build [OPTIONS] PATH | URL | -
error
Run 'docker build --help' for more information
   at Aspire.Hosting.Dcp.ContainerCreator.WaitForTunnelProxyAsync(ContainerNetworkTunnelProxy tunnelProxy, IDcpObjectFactory factory, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 554
   at Aspire.Hosting.Dcp.ContainerCreator.CreateTunnelProxyResourceAsync(IDcpObjectFactory factory, List`1 tunnels, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 415
   at Aspire.Hosting.Dcp.ContainerCreator.EnsureHostConnectivityAsync(ImmutableArray`1 hostDependencies, ContainerCreationContext cctx, IDcpObjectFactory factory, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 478
   at Aspire.Hosting.Dcp.ContainerCreator.CreateHostDependentContainerAsync(RenderedModelResource`1 cr, ImmutableArray`1 hostDependencies, ContainerCreationContext cctx, IDcpObjectFactory factory, CancellationToken cToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 590
   at Aspire.Hosting.Dcp.ContainerCreator.CreateObjectAsync(RenderedModelResource`1 cr, ContainerCreationContext cctx, ILogger logger, IDcpObjectFactory factory, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 218
   at Aspire.Hosting.Dcp.DcpExecutor.CreateResourceReplicasAsync[TDcpResource,TContext](IResource modelResource, IEnumerable`1 replicaResources, IObjectCreator`2 creator, TContext context, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 822

Expected Behavior

Keycloak container should start

Steps To Reproduce

<Project Sdk="Aspire.AppHost.Sdk/13.3.5">

 <!-- redacted -->

  <ItemGroup>
    <PackageReference Include="Aspire.Hosting.JavaScript" Version="13.3.5" />
    <PackageReference Include="Aspire.Hosting.Keycloak" Version="13.3.5-preview.1.26270.6" />
    <PackageReference Include="Aspire.Hosting.PostgreSQL" Version="13.3.5" />
    <PackageReference Include="Aspire.Hosting.RabbitMQ" Version="13.3.5" />
  </ItemGroup>
</Project>

Full AppHost with some redactions:

var builder = DistributedApplication.CreateBuilder(args);

var rabbitmq = builder.AddRabbitMQ("messaging");
var keycloak = builder.AddKeycloak("keycloak", 8088)
    .WithDataVolume();

var postgres = builder
    .AddPostgres("postgres")
    .WithDataVolume()
    .AddDatabase("postgresdb");

var injector = builder.AddProject<Projects.xxx>("injector")
    .WaitFor(rabbitmq)
    .WithReference(rabbitmq)
    .WaitFor(postgres)
    .WithReference(postgres)
    // .WaitFor(keycloak)
    .WithReference(keycloak)
    .WithHttpHealthCheck("/health")
    .WithExternalHttpEndpoints();

var webApi = builder.AddProject<Projects.xxx>("webapi")
    .WaitFor(rabbitmq)
    .WithReference(rabbitmq)
    .WaitFor(postgres)
    .WithReference(postgres)
    // .WaitFor(keycloak)
    .WithReference(keycloak)
    .WithHttpHealthCheck("/health")
    .WithExternalHttpEndpoints();

var frontend = builder.AddViteApp("angular-frontend", "../xxx/xxx", "start")
    .WithReference(webApi)
    .WaitFor(webApi);

builder.Build().Run();

Exceptions (if any)

 Failed to create resource keycloak
Aspire.Hosting.DistributedApplicationException: One or more container network tunnel proxies did not start successfully: 'aspire-container-network-tunnelproxy': Container image for container network tunnel could not be built, or its presence could not be verified: failed to build client proxy image: docker command 'BuildImage' returned with non-zero exit code 125
error
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
error
            Install the buildx component to build images with BuildKit:
error
            https://docs.docker.com/go/buildx/
error
unknown flag: --progress
error
Usage:  docker build [OPTIONS] PATH | URL | -
error
Run 'docker build --help' for more information
   at Aspire.Hosting.Dcp.ContainerCreator.WaitForTunnelProxyAsync(ContainerNetworkTunnelProxy tunnelProxy, IDcpObjectFactory factory, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 554
   at Aspire.Hosting.Dcp.ContainerCreator.CreateTunnelProxyResourceAsync(IDcpObjectFactory factory, List`1 tunnels, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 415
   at Aspire.Hosting.Dcp.ContainerCreator.EnsureHostConnectivityAsync(ImmutableArray`1 hostDependencies, ContainerCreationContext cctx, IDcpObjectFactory factory, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 478
   at Aspire.Hosting.Dcp.ContainerCreator.CreateHostDependentContainerAsync(RenderedModelResource`1 cr, ImmutableArray`1 hostDependencies, ContainerCreationContext cctx, IDcpObjectFactory factory, CancellationToken cToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 590
   at Aspire.Hosting.Dcp.ContainerCreator.CreateObjectAsync(RenderedModelResource`1 cr, ContainerCreationContext cctx, ILogger logger, IDcpObjectFactory factory, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/ContainerCreator.cs:line 218
   at Aspire.Hosting.Dcp.DcpExecutor.CreateResourceReplicasAsync[TDcpResource,TContext](IResource modelResource, IEnumerable`1 replicaResources, IObjectCreator`2 creator, TContext context, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 822

Aspire doctor output

Aspire Environment Check
========================

.NET SDK
  ✅ .NET 10.0.201 installed (x64)  

Container Runtime
  ✅ Docker v29.4.0: running (auto-detected (default)) ← active  

Environment
  ✅ HTTPS development certificate is trusted  

Summary: 3 passed, 0 warnings, 0 failed

Anything else?

Keycloak worked till version 13.3 I think. I'm running Docker under WSL on W11, without Docker Desktop. I've symlinked the Windows Docker pipe to WSL. Worked fine up until 13.3. The other stuff runs fine without any problems :)

dotnet --version
10.0.201

aspire --version
13.3.5+70b33bcb5f64c75e3ab6f57616545f35bd43dc81

[joperezr]

🤖 Aspire triage pass — 2026-05-22 16:33 UTC

Area: area-orchestrator
Kind: regression
Repro: yes-minimal — AppHost snippet + aspire doctor output present in the issue body; error originates in Aspire.Hosting/Dcp/ContainerCreator.cs while building the container network tunnel proxy image (docker build rejects --progress on the legacy builder).
Affected version(s): 13.3.5 (Aspire.AppHost.Sdk 13.3.5, Aspire.Hosting.Keycloak 13.3.5-preview.1.26270.6); reporter states behavior worked through "version 13.3".
Severity: S2 — Keycloak (and any container needing the tunnel proxy) cannot start; no in-app workaround. Environment-adjacent (Docker without buildx under WSL) but Aspire previously worked in this setup.

Urgency: 🔴 servicing — recommend milestone 13.3.x
Reason: regression within 13.3.x for users on legacy Docker builder (no buildx); core orchestrator startup path is broken with no workaround. Prior partial fixes #16897 and #17052 do not cover this case.

Suggested owner(s): @karolz-ms (score ~30+), backup @danegsta
Evidence:

• @karolz-ms closed-as-completed many recent area-orchestrator issues including [13.3] AddKeycloak + AddFlagd with WaitFor hangs in Starting state, Container CRD never submitted to DCP (regression of #15041) #16897 (one of the prior Keycloak/tunnel-proxy fixes referenced here), Starting Dashboard failing after update to 13.3.3 #16866, [13.3] Container Tunnel fails to start without internet connectivity #16615 (co), [Container Tunnel] OtlpEndpointReferenceGatherer hangs forever for containers with OtlpExporterAnnotation when no containers are tunnel-dependent #15041, aspire logs with no arguments is really slow #14646 (co), Failing test: ContainerTunnelWorksWithYarp #14325, Env vars are missing from the dashboard #14269, [main] Final logs for containers that exit quickly are missing #14262, Network Tunnel build failure shouldn't be a debug message #13892, Failing test: Aspire.Hosting.Tests.DistributedApplicationTests.AllocatedPortsAssignedAfterHookRuns #13833, Container considered FailedToStart if it starts then immediately exists #13760, No Logs if container fails to start due to bad bind mount #13756, Dashboard doesn't load if Docker not running and ASPIRE_ENABLE_CONTAINER_TUNNEL #12998, [DCP] Executables that are not able to be run via IDE should fall back to process execution #12522, Support for DNS aliases #11906
• @danegsta closed-as-completed recent area-orchestrator issues WithOtlpExporter() breaks ContainerLifetime.Persistent, lifecycle key mismatch on every run #17191, [13.3] Container Tunnel fails to start without internet connectivity #16615, CosmosDB Preview Emulator Regression from 13.1.2 to 13.2.0 - ContainerLifetime.Persistent does not keep the same container #15626, Failing test: DistributedApplicationTests.VerifyContainerSucceedsWithCreateFileContinueOnError #15195, [AspireE2E][Linux]Create Aspire Starter App ~ 10.0, run the project, open link for webfrontend, then navigate to "Weather", the browser always show "Loading...",an exception of type 'System.Net.Http.HttpRequestException' occurred #13563, [AspireE2E][Linux] The start time in the dashboard Resources page is incorrect #13455, Failure to create certs directory and other permissions issues on MacOS #13138, Certificates that the X509Store and X509Certificate2 consider valid can result in errors when loaded in OpenSSL #12693, Excited to finally try out Aspire but SSL error running starter project #7443, Sql Server container port is not accessible after Aspire is shutdown #7046; co-resolved [13.3] AddKeycloak + AddFlagd with WaitFor hangs in Starting state, Container CRD never submitted to DCP (regression of #15041) #16897
• Cited stack frames in src/Aspire.Hosting/Dcp/ContainerCreator.cs map to the orchestrator area owned by this team

Confidence: medium
Needs human?: yes — regression baseline is "version 13.3" (specific patch unclear); please confirm the last good 13.3.x patch and whether this should land in 13.3.x or be deferred. Servicing decisions warrant human sign-off.

Dry-run mode — no labels or milestone applied. Reply /triage apply to promote, or edit and reapply.

[afscrome]

Looks like you’re missing docker builds - make sure that is installed as the container tunnel requires it.

https://github.com/docker/buildx

[karolz-ms]

@milanlugn Alex is right. Can you try installing buildx and running the application again?

[milanlugn]

This was indeed the issue and the container is now running again. It's weird because it was also running properly the past few weeks, but maybe an update broke something.

Thanks!