crowdsecurity/crowdsec · info

crowdsec.enable not true

Error message

crowdsec.enable not true

What it means

The container/service has crowdsec.enable set, but its value is not the string "true" (case-insensitive), so the entity is intentionally not acquired. This is the normal opt-in gate returning a sentinel error rather than a malfunction; the source logs it at Debug level because opting out is expected behavior.

Source

Thrown at pkg/acquisition/modules/docker/source.go:97

	if len(parsedLabels) == 0 {
		d.logger.Tracef("%s has no 'crowdsec' labels set, ignoring %s: %s", entityType, entityType, entityID)
		return nil, errors.New("no crowdsec labels")
	}

	if _, ok := parsedLabels["enable"]; !ok {
		d.logger.Errorf("%s has 'crowdsec' labels set but no 'crowdsec.enable' key found", entityType)
		return nil, errors.New("no crowdsec.enable key")
	}

	enable, ok := parsedLabels["enable"].(string)
	if !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set but it's not a string", entityType)
		return nil, errors.New("crowdsec.enable not a string")
	}

	if strings.ToLower(enable) != "true" {
		d.logger.Debugf("%s has 'crowdsec.enable' label not set to true ignoring %s: %s", entityType, entityType, entityID)
		return nil, errors.New("crowdsec.enable not true")
	}

	if _, ok = parsedLabels["labels"]; !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set to true but no 'labels' keys found", entityType)
		return nil, errors.New("no labels key")
	}

	labelsTypeCast, ok := parsedLabels["labels"].(map[string]any)
	if !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set to true but 'labels' is not a map", entityType)
		return nil, errors.New("labels not a map")
	}

	d.logger.Debugf("%s labels %+v", entityType, labelsTypeCast)

	labels := make(map[string]string)

	for k, v := range labelsTypeCast {

View on GitHub (pinned to 909b515798)

Solutions

1. Set crowdsec.enable=true (any casing) on the container/service
2. If acquisition is unwanted, remove the crowdsec.enable label entirely and silence the noise at the source
3. Replace unsupported truthy spellings (yes/1/on) with the literal string true
4. Re-check the container's resolved labels with 'docker inspect' to catch template/env expansion issues

Example fix

# before
labels:
  - crowdsec.enable=yes
# after
labels:
  - crowdsec.enable=true

if v, ok := labels["crowdsec.enable"]; ok && strings.ToLower(v) != "true" {
	log.Infof("container %s: crowdsec disabled (enable=%s), skipping", ctr.ID, v)
}

func isEnabled(labels map[string]string) bool {
	return strings.EqualFold(labels["crowdsec.enable"], "true")
}

if _, err := source.EvalContainer(ctx, ctr); err != nil {
	if err.Error() == "crowdsec.enable not true" {
		// expected opt-out: not an error condition
		return nil
	}
	return err
}

When it happens

Trigger: processCrowdsecLabels (via EvalContainer/EvalService) reads crowdsec.enable with a value other than true after ToLower — e.g. enable=false, enable=yes, enable=1, or an empty string.

Common situations: User set crowdsec.enable=false to disable acquisition but expects logs anyway; used 'yes' or '1' assuming truthy handling; leftover enable label from a decommissioned setup; variable expansion left the label empty.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• no crowdsec.enable key
• no labels key
• crowdsec.enable not a string
• labels not a map
• missing lapi client credentials

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ee6e989bc15a1565. Report an issue: GitHub.