crowdsecurity/crowdsec · error

connection aborted, shutting down docker watcher

Error message

connection aborted, shutting down docker watcher

What it means

Raised from subscribeEvents (called by Watch) in the docker datasource: the connection to the docker daemon's events stream was aborted and the watcher is shutting down. subscribeEvents normally retries Events() with exponential backoff on failures; reaching this error means the retry loop gave up — the context/tomb is done or the daemon is unreachable for good, so the docker watcher terminates rather than spinning forever.

Source

Thrown at pkg/acquisition/modules/docker/run.go:386

	case err := <-result.Err:
		if err != nil {
			return nil, fmt.Errorf("docker events connection failed: %w", err)
		}
	default:
	}

	return &subscription{events: result.Messages, errs: result.Err}, nil
}

// subscribeEvents will loop until it can successfully call d.Client.Events()
// without immediately receiving an error. It applies exponential backoff on failures.
// Returns the new (eventsChan, errChan) pair or an error if context/tomb is done.
func (d *Source) subscribeEvents(ctx context.Context) (*subscription, error) {
	select {
	case <-ctx.Done():
		return nil, ctx.Err()
	case <-d.t.Dying():
		return nil, errors.New("connection aborted, shutting down docker watcher")
	default:
	}

	d.logger.Infof("Subscribing to Docker events")

	operation := func() (*subscription, error) {
		select {
		case <-ctx.Done():
			return nil, backoff.Permanent(ctx.Err())
		case <-d.t.Dying():
			return nil, backoff.Permanent(errors.New("connection aborted, shutting down docker watcher"))
		default:
		}

		return d.trySubscribeEvents(ctx)
	}

	notify := func(err error, wait time.Duration) {

View on GitHub (pinned to 909b515798)

Solutions

1. Check docker daemon availability and socket permissions (docker_host / DOCKER_HOST)
2. Inspect crowdsec logs for the preceding backoff errors to find the root cause (socket gone, daemon restart, permission denied)
3. If the daemon restarts frequently, ensure the socket path is stable or use the TCP endpoint with proper TLS

When it happens

Trigger: Thrown at pkg/acquisition/modules/docker/run.go:386 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Connection failures: ECONNREFUSED, ECONNRESET, and friends — why connections get refused, reset, or dropped.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/cfe1bac67ed335e6. Report an issue: GitHub.