crowdsecurity/crowdsec · error

failed to get docker info: %w

Error message

failed to get docker info: %w

What it means

During Configure, the docker source queries the Docker daemon with client.Info to determine whether the node is an active Swarm manager. If the daemon call fails (daemon unreachable, socket permission denied, Docker not installed), configuration is aborted with this wrapped error.

Source

Thrown at pkg/acquisition/modules/docker/config.go:175

	d.logger.Tracef("Actual DockerAcquisition configuration %+v", d.Config)

	opts := []client.Opt{
		client.FromEnv,
	}

	if d.Config.DockerHost != "" {
		opts = append(opts, client.WithHost(d.Config.DockerHost))
	}

	d.Client, err = client.New(opts...)
	if err != nil {
		return err
	}

	info, err := d.Client.Info(ctx, client.InfoOptions{})
	if err != nil {
		return fmt.Errorf("failed to get docker info: %w", err)
	}

	if info.Info.Swarm.LocalNodeState == dockerTypesSwarm.LocalNodeStateActive && info.Info.Swarm.ControlAvailable {
		hasServiceConfig := d.Config.hasServiceConfig()
		if hasServiceConfig {
			d.isSwarmManager = true
			d.logger.Info("node is swarm manager, enabling swarm detection mode")
		}

		if !hasServiceConfig {
			// we set to false cause user didnt provide service configuration even though we are a swarm manager
			d.isSwarmManager = false
			d.logger.Warn("node is swarm manager, but no service configuration provided - service monitoring will be disabled, if this is unintentional please apply constraints")
		}
	}

	d.backoffFactory = newDockerBackOffFactory()

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the docker daemon is running: `docker info` must succeed as the same user.
2. Check/fix the `docker_host` config or DOCKER_HOST env (unix:///var/run/docker.sock or tcp://host:2375).
3. Mount /var/run/docker.sock into the CrowdSec container and grant read/write, or add the user to the `docker` group.
4. If using tcp, ensure the API port is exposed and reachable (and TLS certs are valid if enabled).

Example fix

// before (acquis.yaml)
source: docker
// after — explicit reachable host
source: docker
docker_host: unix:///var/run/docker.sock

// shell preflight
cmd := exec.Command("docker", "info")
if err := cmd.Run(); err != nil {
    return errors.New("docker daemon not reachable for this user/host")
}

if err := src.Configure(ctx); err != nil {
    if strings.Contains(err.Error(), "failed to get docker info") {
        log.Fatalf("docker daemon unreachable: %v — check docker_host and socket permissions", err)
    }
    return err
}

When it happens

Trigger: Configure called with d.Client whose Info(ctx, client.InfoOptions{}) request fails: docker daemon down, wrong DOCKER_HOST, unix socket not accessible, or no docker API client configured at all.

Common situations: CrowdSec running in a container without the docker socket mounted; user not in the `docker` group; DOCKER_HOST pointing at a dead host/port; Docker Desktop not running on the machine.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• docker events connection failed: %w
• no crowdsec.enable key
• crowdsec.enable not a string
• crowdsec.enable not true
• no labels key

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/2b9ae15a3f1c7553. Report an issue: GitHub.