crowdsecurity/crowdsec · error

invalid DSN %s for docker source, must start with %s://

Error message

invalid DSN %s for docker source, must start with %s://

What it means

ConfigureByDSN checks that the DSN's URL scheme equals the docker source name ("docker"). A DSN whose parsed scheme differs is rejected because it was handed to the wrong source type — usually a misconfigured acquisition entry or a dispatch bug.

Source

Thrown at pkg/acquisition/modules/docker/config.go:206

			d.logger.Warn("node is swarm manager, but no service configuration provided - service monitoring will be disabled, if this is unintentional please apply constraints")
		}
	}

	d.backoffFactory = newDockerBackOffFactory()

	return nil
}

func (d *Source) ConfigureByDSN(_ context.Context, dsn string, labels map[string]string, logger *log.Entry, uuid string) error {
	var err error

	parsedURL, err := url.Parse(dsn)
	if err != nil {
		return fmt.Errorf("failed to parse DSN %s: %w", dsn, err)
	}

	if parsedURL.Scheme != d.GetName() {
		return fmt.Errorf("invalid DSN %s for docker source, must start with %s://", dsn, d.GetName())
	}

	d.Config = Configuration{
		FollowStdout: true,
		FollowStdErr: true,
	}
	d.Config.UniqueId = uuid
	d.Config.ContainerName = make([]string, 0)
	d.Config.ContainerID = make([]string, 0)
	d.runningContainerState = tracker.NewTracker[*ContainerConfig]()
	d.runningServiceState = tracker.NewTracker[*ContainerConfig]()
	d.Config.Mode = configuration.CAT_MODE
	d.logger = logger
	d.Config.Labels = labels

	opts := []client.Opt{
		client.FromEnv,
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Rewrite the DSN so it starts exactly with `docker://` (lowercase, no space).
2. Check the acquisition config line for typos or stray characters around the scheme.
3. If the DSN belongs to another source type, move it to the correct source block.

Example fix

// before
log_path: 'Docker ://mycontainer'
// after
log_path: 'docker://mycontainer'

u, err := url.Parse(dsn)
if err == nil && u.Scheme != "docker" {
    return fmt.Errorf("DSN scheme %q is not docker://", u.Scheme)
}

When it happens

Trigger: ConfigureByDSN receiving a dsn whose url.Parse(...).Scheme != "docker", e.g. `docker ://x` with a space, `Docker://x` (case), or a journald/file DSN routed to the docker source.

Common situations: Typo in acquis.yaml `log_path` (space after the scheme or uppercase name); programmatic source selection matching the wrong module; copy-paste between source configs.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• empty journalctl:// DSN
• empty loki host
• failed to parse DSN %s: %w
• empty %s DSN
• unknown level %s: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9bd9c4699a33756d. Report an issue: GitHub.