What causes "failed to parse DSN %s: %w" in crowdsecurity/crowdsec?

Inspect the DSN string for illegal URL characters and remove/escape them (use %XX encoding).

failed to parse DSN %s: %w

Error message

failed to parse DSN %s: %w

What it means

ConfigureByDSN parses the acquisition DSN string with url.Parse before interpreting it as a docker source. If url.Parse returns an error (malformed URL syntax), the DSN string is included and the underlying error wrapped with this prefix.

Source

Thrown at pkg/acquisition/modules/docker/config.go:202

		if !hasServiceConfig {
			// we set to false cause user didnt provide service configuration even though we are a swarm manager
			d.isSwarmManager = false
			d.logger.Warn("node is swarm manager, but no service configuration provided - service monitoring will be disabled, if this is unintentional please apply constraints")
		}
	}

	d.backoffFactory = newDockerBackOffFactory()

	return nil
}

func (d *Source) ConfigureByDSN(_ context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {
	var err error

	parsedURL, err := url.Parse(dsn)
	if err != nil {
		return fmt.Errorf("failed to parse DSN %s: %w", dsn, err)
	}

	if parsedURL.Scheme != d.GetName() {
		return fmt.Errorf("invalid DSN %s for docker source, must start with %s://", dsn, d.GetName())
	}

	d.Config = Configuration{
		FollowStdout: true,
		FollowStdErr: true,
	}
	d.Config.UniqueId = uuid
	d.Config.ContainerName = make([]string, 0)
	d.Config.ContainerID = make([]string, 0)
	d.runningContainerState = tracker.NewTracker[*ContainerConfig]()
	d.runningServiceState = tracker.NewTracker[*ContainerConfig]()
	d.Config.Mode = configuration.CAT_MODE
	d.logger = logger
	d.Config.Labels = labels

View on GitHub (pinned to 909b515798)

Solutions

Inspect the DSN string for illegal URL characters and remove/escape them (use %XX encoding).
Ensure percent-encodings are valid hex (e.g. %20 not %zz).
Simplify the DSN to a known-good form: docker://<container>?<params>.

Example fix

// before
log_path: 'docker://mycontainer?log_level=100%'
// after
log_path: 'docker://mycontainer?log_level=info'

Defensive patterns

Strategy: validation

Validate before calling

if _, err := url.Parse(dsn); err != nil {
    return fmt.Errorf("malformed docker DSN %q: %w", dsn, err)
}

Prevention

Percent-encode special characters in DSN query values.
Avoid pasting DSNs with newlines/trailing spaces from docs.
Keep DSNs generated from templates simple and validate after rendering.

When it happens

Trigger: ConfigureByDSN called with a dsn string that url.Parse rejects — e.g. stray control characters, invalid percent-encoding (`%zz`), or malformed IPv6 literal brackets.

Common situations: A docker:// DSN with an accidentally pasted newline or space; unescaped `%` in a query parameter; corrupted acquis.yaml entry with broken quoting.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/99e69a848e49f005. Report an issue: GitHub.