crowdsecurity/crowdsec · error

no container found named: %s, can't run one shot acquisition

Error message

no container found named: %s, can't run one shot acquisition

What it means

OneShotAcquisition (crowdsec docker datasource, `docker run --rm -i` style one-shot mode) iterates the configured containers via `docker ps`/list and sets foundOne only when a container matching Config.ContainerName[0] is found. If no running container matches the configured name at acquisition time, it returns this error instead of reading logs. It means the requested container does not exist or is not currently running.

Source

Thrown at pkg/acquisition/modules/docker/run.go:126

					out <- evt

					d.logger.Debugf("Sent line to parsing: %+v", evt.Line.Raw)
				}
			}

			err = scanner.Err()
			if err != nil {
				d.logger.Errorf("Got error from docker read: %s", err)
			}

			d.runningContainerState.Set(container.ID, containerConfig)
		}
	}

	t.Kill(nil)

	if !foundOne {
		return fmt.Errorf("no container found named: %s, can't run one shot acquisition", d.Config.ContainerName[0])
	}

	return nil
}

func (d *Source) EvalContainer(ctx context.Context, container dockerContainer.Summary) *ContainerConfig {
	// fixed params
	newConfig := func(name string, labels map[string]string) *ContainerConfig {
		return NewContainerConfig(d.containerLogsOptions, container.ID, name, labels, d.getContainerTTY(ctx, container.ID))
	}

	// ID match

	if slices.Contains(d.Config.ContainerID, container.ID) {
		return newConfig(container.Names[0], d.Config.Labels)
	}

	// name match

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the container is running: `docker ps | grep <name>`, and use the exact name or full ID from that output in container_name.
2. Start the target container before running one-shot acquisition.
3. If using docker-socket-proxy, allow the container list/inspect endpoints so the source can find the container.
4. Check EvalContainer matching (name, ID prefix, or regexp match in pkg/acquisition/modules/docker/run.go) and align your configured name with the matching rules.

Example fix

// before (acquis.yaml)
source: docker
container_name:
  - my-nginx
// after — match the real running container name shown by `docker ps`
source: docker
container_name:
  - /nginx$

// Go, before OneShotAcquisition
func containerRunning(ctx context.Context, cli *client.Client, name string) (bool, error) {
	sums, err := cli.ContainerList(ctx, container.ListOptions{})
	if err != nil {
		return false, err
	}
	for _, s := range sums {
		for _, n := range s.Names {
			if strings.TrimPrefix(n, "/") == name || s.ID == name {
				return true, nil
			}
		}
	}
	return false, nil
}

if !found {
	return fmt.Errorf("container %q not running; check `docker ps` before one-shot acquisition", name)
}

err := src.OneShotAcquisition(ctx, out)
if err != nil && strings.Contains(err.Error(), "no container found named") {
	// resolve correct container name/ID and retry
}

When it happens

Trigger: Running one-shot docker acquisition (`cscli`/`crowdsec -type docker` one-shot, e.g. in CI or tests) with Config.ContainerName[0] set to a name that does not match any running container — wrong name, container stopped/exited, or only an ID prefix given where exact name/ID matching is expected.

Common situations: Typo in container_name in acquis.yaml; container crashed before the acquisition ran; using a docker-socket-proxy that hides the container; testing with `docker run` on a host where the container was already removed; name given with leading slash or compose-prefixed name (e.g. project_service_1) that doesn't match.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• unable to read logs from container %s: %w
• unable to read logs from service %s: %w
• appsec datasource requires a hub. this is a bug, please repo
• appsec datasource requires a lapi client configuration. this
• no crowdsec.enable key

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b58575ba7193932c. Report an issue: GitHub.