crowdsecurity/crowdsec · error

container_name_regexp: %w

Error message

container_name_regexp: %w

What it means

Each container_name_regexp entry is compiled with regexp.Compile during UnmarshalConfig. An invalid Go regular expression fails compilation and is wrapped as `container_name_regexp: <err>`, rejecting the docker datasource configuration.

Source

Thrown at pkg/acquisition/modules/docker/config.go:95

		return errors.New("use_service_labels and service_name, service_id, service_id_regexp, service_name_regexp are mutually exclusive")
	}

	if d.Config.CheckInterval != "" && d.logger != nil {
		d.logger.Warn("check_interval is ignored: this datasource now uses events instead of polling (will be removed in a future version)")
	}

	if d.Config.Mode == "" {
		d.Config.Mode = configuration.TAIL_MODE
	}

	if d.Config.Mode != configuration.CAT_MODE && d.Config.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %s for docker datasource", d.Config.Mode)
	}

	for _, cont := range d.Config.ContainerNameRegexp {
		compiled, err := regexp.Compile(cont)
		if err != nil {
			return fmt.Errorf("container_name_regexp: %w", err)
		}

		d.compiledContainerName = append(d.compiledContainerName, compiled)
	}

	for _, cont := range d.Config.ContainerIDRegexp {
		compiled, err := regexp.Compile(cont)
		if err != nil {
			return fmt.Errorf("container_id_regexp: %w", err)
		}

		d.compiledContainerID = append(d.compiledContainerID, compiled)
	}

	for _, svc := range d.Config.ServiceNameRegexp {
		compiled, err := regexp.Compile(svc)
		if err != nil {
			return fmt.Errorf("service_name_regexp: %w", err)

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the regex per the error's position hint — usually an unbalanced paren or dangling escape
2. Avoid RE2-unsupported constructs like lookaheads/lookbehinds; rewrite with plain matching
3. Quote the regex in YAML and double backslashes where needed to survive YAML parsing
4. Test the pattern with go playground regexp or `go test` before deploying

Example fix

// before
container_name_regexp:
  - foo(?=bar)
// after
container_name_regexp:
  - foobar.*

for _, re := range cfg.ContainerNameRegexp {
    if _, err := regexp.Compile(re); err != nil {
        return fmt.Errorf("container_name_regexp %q invalid: %v", re, err)
    }
}

if err := ds.UnmarshalConfig(cfgYaml); err != nil {
    if strings.Contains(err.Error(), "container_name_regexp") { /* fix the regex quoted in the wrapped error */ }
    return err
}

When it happens

Trigger: Acquisition YAML contains a malformed regex in container_name_regexp, e.g. unbalanced parenthesis `foo(bar`, dangling escape `foo\` or invalid repetition `foo{2,1}`.

Common situations: Users writing PCRE-only syntax not supported by Go's RE2 (e.g. lookahead (?=...)), copy-pasted regexes with unescaped characters, YAML mangling backslashes when not quoted.

Related errors

• unsupported mode %s for docker datasource
• container_id_regexp: %w
• service_name_regexp: %w
• service_id_regexp: %w
• path must start with /

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ba096164af7ecb75. Report an issue: GitHub.