{"record":{"id":"25571dbdb2aef8e3","repo":"crowdsecurity/crowdsec","slug":"docker-events-connection-failed-w","errorCode":null,"errorMessage":"docker events connection failed: %w","messagePattern":"docker events connection failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/acquisition/modules/docker/run.go","lineNumber":370,"sourceCode":"func (d *Source) trySubscribeEvents(ctx context.Context) (*subscription, error) {\n\tfilters := client.Filters{\n\t\t\"type\": {\n\t\t\t\"container\": true,\n\t\t\t\"service\":   d.isSwarmManager,\n\t\t},\n\t}\n\n\topts := client.EventsListOptions{\n\t\tFilters: filters,\n\t}\n\n\tresult := d.Client.Events(ctx, opts)\n\n\t// Is there an immediate error (proxy/daemon unavailable) ?\n\tselect {\n\tcase err := <-result.Err:\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"docker events connection failed: %w\", err)\n\t\t}\n\tdefault:\n\t}\n\n\treturn &subscription{events: result.Messages, errs: result.Err}, nil\n}\n\n// subscribeEvents will loop until it can successfully call d.Client.Events()\n// without immediately receiving an error. It applies exponential backoff on failures.\n// Returns the new (eventsChan, errChan) pair or an error if context/tomb is done.\nfunc (d *Source) subscribeEvents(ctx context.Context) (*subscription, error) {\n\tselect {\n\tcase <-ctx.Done():\n\t\treturn nil, ctx.Err()\n\tcase <-d.t.Dying():\n\t\treturn nil, errors.New(\"connection aborted, shutting down docker watcher\")\n\tdefault:\n\t}","sourceCodeStart":352,"sourceCodeEnd":388,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/docker/run.go#L352-L388","documentation":"trySubscribeEvents calls d.Client.Events(ctx, opts) and checks the error channel non-blockingly for an immediate failure. If the docker daemon/socket is unreachable or the Events stream is rejected right away, the error is wrapped as \"docker events connection failed\". It signals the initial subscription to the docker event stream failed, not a mid-stream error.","triggerScenarios":"Calling the docker datasource startup (live mode, container discovery via events) when the docker daemon is down, the docker socket path is wrong, the user lacks permission on /var/run/docker.sock, or a docker-socket-proxy rejects the /events endpoint.","commonSituations":"CrowdSec started in a container without mounting /var/run/docker.sock; DOCKER_HOST pointing to a dead daemon; socket-proxy config missing GET /events in the allowed API; docker restarted while the source subscribes at boot.","solutions":["Check the daemon is reachable: `docker events --since 1s` on the same host/socket; fix DOCKER_HOST or the socket path in the docker datasource config.","Fix permissions: add the crowdsec user to the docker group or adjust socket ACLs.","If behind docker-socket-proxy, whitelist the /events (and containers) endpoints.","Restart crowdsec once the daemon is up — the source retries subscription on the next manager loop."],"exampleFix":"// before (acquis.yaml)\nsource: docker\n// no docker_host, daemon not reachable\n// after — point at a working daemon/socket\nsource: docker\ndocker_host: unix:///var/run/docker.sock","handlingStrategy":"retry","validationCode":"// Go, before starting the source\nctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)\ndefer cancel()\nif _, err := cli.Ping(ctx); err != nil {\n\treturn fmt.Errorf(\"docker daemon unreachable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"sub, err := trySubscribeEvents(ctx)\nif err != nil && strings.Contains(err.Error(), \"docker events connection failed\") {\n\t// exponential backoff, resubscribe once daemon is back\n\ttime.Sleep(backoff.Next())\n\tgoto retry\n}","preventionTips":["Health-check the docker socket (client.Ping) at startup and in readiness probes.","Mount /var/run/docker.sock when crowdsec runs in a container.","Whitelist /events and /containers in docker-socket-proxy configs.","Monitor daemon uptime; treat docker restarts as expected source restarts."],"tags":["docker","events","connection","network"],"backgroundTag":"connection-refused","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}