crowdsecurity/crowdsec · error
capacity must be -1
Error message
capacity must be -1
What it means
A bucket validated by this Bayesian Validate must have Capacity == -1, i.e. it must never leak by capacity; Bayesian buckets are purely probability-driven and cannot use the classic leaky-bucket capacity mechanism. Validate enforces this invariant at load time.
Source
Thrown at pkg/leakybucket/buckettype.go:121
}
type BayesianType struct{}
func (BayesianType) Validate(f *BucketFactory) error {
if len(f.Spec.BayesianConditions) == 0 {
return errors.New("bayesian conditions are required")
}
if f.Spec.BayesianPrior <= 0 || f.Spec.BayesianPrior > 1 {
return errors.New("invalid prior: must be > 0 and <= 1")
}
if f.Spec.BayesianThreshold == 0 || f.Spec.BayesianThreshold > 1 {
return errors.New("invalid threshold: must be > 0 and <= 1")
}
if f.Spec.Capacity != -1 {
return errors.New("capacity must be -1")
}
return nil
}
func (BayesianType) BuildProcessors(_ *BucketFactory) []Processor {
return []Processor{&DumbProcessor{}}
}
View on GitHub (pinned to 909b515798)
Solutions
- Set `capacity: -1` in the bucket spec
- Remove the capacity line entirely only if defaults yield -1; otherwise set it explicitly to -1
- Use a classic (non-bayesian) bucket type if you actually need capacity-based leaking
Example fix
# before type: bayesian capacity: 10 # after type: bayesian capacity: -1
Defensive patterns
Strategy: validation
Validate before calling
if cfg.Type == "bayesian" && cfg.Capacity != -1 {
return fmt.Errorf("bayesian buckets require capacity: -1, got %d", cfg.Capacity)
} Prevention
- Never copy `capacity:` into bayesian scenarios
- Document bayesian scenarios with capacity: -1 in templates
- Lint scenario files for type/capacity conflicts
When it happens
Trigger: Loading a Bayesian-type bucket config whose Spec.Capacity is set to any value other than -1 (e.g. capacity: 5 or capacity: 10).
Common situations: Copy-pasting a classic/leaky bucket YAML and only switching the type to bayesian, leaving capacity configured.
Understand the failure class
Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.
Related errors
- invalid threshold: must be > 0 and <= 1
- bucket must have name
- description is mandatory
- missing filter directive
- empty scope information
AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06).
Data as JSON: /api/errors/fd79e27bb77791b6.
Report an issue: GitHub.