Reply to self here for posterity: for anyone else who may one day run into this problem. I have worked around my issue with gRPC issues by using a different wait strategy with my

testcontainers

fixtures. Specifically, previously I was waiting only for the first registered port (the GRPC port in this case) to start listening before starting tests. This was inadequate: spicedb was NOT ready for reasons I don't understand (nor can I be bothered finding out). Instead, I used a log tailing wait strategy and specified a wait for the server to emit the 'http server started serving' string (I am obviously also enabling the http server under test) and this has resolved my woes: I only get GRPC communication issues now if I do something stupid/intentionally bad like nuking spicedb.

^ ended up doing the exact same thing when I was setting up my tests with spicedb, something like

js
const container = new GenericContainer('authzed/spicedb:v1.14.0')
    .withExposedPorts(
      {
        container: 50051,
        host: 50051,
      },
      {
        container: 50052,
        host: 50052,
      },
    )
    .withCopyFilesToContainer([
      {
        source: 'src/others/schema.yaml',
        target: '/etc/schema.yaml',
      },
    ])
    .withWaitStrategy(new LogWaitStrategy('started serving'))
    .withEntrypoint([
      'spicedb',
      'serve-testing',
      '--load-configs',
      '/etc/schema.yaml',
    ]);

for some reason the default waitstrategy wouldn't work

Same here. you could use the debug image that should have a shell so the health command from testcontainers is working. There were already discussion about this topic in the history here. Our solution is

spiceDb = GenericContainer(DockerImageName.parse("authzed/spicedb:latest"))
      .withImagePullPolicy(PullPolicy.alwaysPull())
      // We are enabling http to just check that the container is running. Important is the order of the exposedPorts.
      .withCommand("serve-testing --http-enabled")
      .withExposedPorts(8443, 50051)
      .waitingFor(Wait.forListeningPort())

@Saturas Thanks for sharing this piece of code. It really helped. How I can write schema to it once the container is ready?

You could do it like perseus did and load it into the container. We wrote a schemaWriter class but if would prefer his solution.

const container = new GenericContainer('authzed/spicedb:v1.14.0')
    .withExposedPorts(
      {
        container: 50051,
        host: 50051,
      },
      {
        container: 50052,
        host: 50052,
      },
    )
    .withCopyFilesToContainer([
      {
 **       source: 'src/others/schema.yaml',
        target: '/etc/schema.yaml',**
      },
    ])
    .withWaitStrategy(new LogWaitStrategy('started serving'))
    .withEntrypoint([
      'spicedb',
      'serve-testing',
**      '--load-configs',
      '/etc/schema.yaml',**
    ]);