What causes "container_id_regexp: %w" in crowdsecurity/crowdsec?

Validate the regex syntax and fix it (test with regexp.Compile or an RE2 playground).

container_id_regexp: %w

Error message

container_id_regexp: %w

What it means

The docker acquisition source compiles every entry of the `container_id_regexp` configuration list into Go regular expressions during UnmarshalConfig. If regexp.Compile fails for any entry, the error is wrapped with this prefix and configuration is aborted. It means one of the container_id_regexp values is not a syntactically valid RE2 regular expression.

Source

Thrown at pkg/acquisition/modules/docker/config.go:104

	}

	if d.Config.Mode != configuration.CAT_MODE && d.Config.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %s for docker datasource", d.Config.Mode)
	}

	for _, cont := range d.Config.ContainerNameRegexp {
		compiled, err := regexp.Compile(cont)
		if err != nil {
			return fmt.Errorf("container_name_regexp: %w", err)
		}

		d.compiledContainerName = append(d.compiledContainerName, compiled)
	}

	for _, cont := range d.Config.ContainerIDRegexp {
		compiled, err := regexp.Compile(cont)
		if err != nil {
			return fmt.Errorf("container_id_regexp: %w", err)
		}

		d.compiledContainerID = append(d.compiledContainerID, compiled)
	}

	for _, svc := range d.Config.ServiceNameRegexp {
		compiled, err := regexp.Compile(svc)
		if err != nil {
			return fmt.Errorf("service_name_regexp: %w", err)
		}

		d.compiledServiceName = append(d.compiledServiceName, compiled)
	}

	for _, svc := range d.Config.ServiceIDRegexp {
		compiled, err := regexp.Compile(svc)
		if err != nil {
			return fmt.Errorf("service_id_regexp: %w", err)

View on GitHub (pinned to 909b515798)

Solutions

Validate the regex syntax and fix it (test with regexp.Compile or an RE2 playground).
Remove PCRE-only constructs (lookahead/lookbehind, backreferences) — Go regexp does not support them.
Escape literal special characters (e.g. `.` -> `\.`) in the pattern.
If a plain container ID is intended, use the `container_id` config key instead of a regexp.

Example fix

// before
container_id_regexp:
  - ^a(b?c$   # unbalanced group
// after
container_id_regexp:
  - ^a(bc)?$

Defensive patterns

Strategy: validation

Validate before calling

for _, re := range cfg.ContainerIDRegexp {
    if _, err := regexp.Compile(re); err != nil {
        return fmt.Errorf("invalid container_id_regexp %q: %w", re, err)
    }
}

Prevention

Unit-test every regex in your acquis config with regexp.Compile before deploying.
Avoid PCRE-only syntax; Go uses RE2.
Prefer exact container_id/container_name lists when regex is unnecessary.

When it happens

Trigger: Calling Configure/UnmarshalConfig on the docker source while d.Config.ContainerIDRegexp contains a string that Go's regexp.Compile rejects (unbalanced parens, bad quantifiers like `*` at start, invalid escapes, stray `[`).

Common situations: Hand-edited acquis.yaml DSN or YAML config with a typo in the regex; copying PCRE-only syntax (lookaheads, backreferences) unsupported by Go's RE2 engine; unescaped special characters in a container ID prefix.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/247cb3c9c0fbf0f8. Report an issue: GitHub.