crowdsecurity/crowdsec · error

no crowdsec.enable key

Error message

no crowdsec.enable key

What it means

The docker acquisiton source found at least one 'crowdsec.*' label on the container/service, but the required 'crowdsec.enable' label is missing. processCrowdsecLabels only accepts entities that explicitly opt in with enable=true, so without that key the entity is rejected and never acquired. It is a user configuration error on the Docker entity, not an internal failure.

Source

Thrown at pkg/acquisition/modules/docker/source.go:86

func (d *Source) getContainerLabels(ctx context.Context, containerID string) map[string]any {
	containerDetails, err := d.Client.ContainerInspect(ctx, containerID, client.ContainerInspectOptions{})
	if err != nil {
		return map[string]any{}
	}

	return parseLabels(containerDetails.Container.Config.Labels)
}

func (d *Source) processCrowdsecLabels(parsedLabels map[string]any, entityID string, entityType string) (map[string]string, error) {
	if len(parsedLabels) == 0 {
		d.logger.Tracef("%s has no 'crowdsec' labels set, ignoring %s: %s", entityType, entityType, entityID)
		return nil, errors.New("no crowdsec labels")
	}

	if _, ok := parsedLabels["enable"]; !ok {
		d.logger.Errorf("%s has 'crowdsec' labels set but no 'crowdsec.enable' key found", entityType)
		return nil, errors.New("no crowdsec.enable key")
	}

	enable, ok := parsedLabels["enable"].(string)
	if !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set but it's not a string", entityType)
		return nil, errors.New("crowdsec.enable not a string")
	}

	if strings.ToLower(enable) != "true" {
		d.logger.Debugf("%s has 'crowdsec.enable' label not set to true ignoring %s: %s", entityType, entityType, entityID)
		return nil, errors.New("crowdsec.enable not true")
	}

	if _, ok = parsedLabels["labels"]; !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set to true but no 'labels' keys found", entityType)
		return nil, errors.New("no labels key")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add the label crowdsec.enable=true to the container/service
2. Fix the label key spelling: it must be exactly 'crowdsec.enable' (e.g. correct crowdsec.enabled or crowdsec-enable)
3. If the container should not be acquired, remove all crowdsec.* labels instead of leaving a partial set
4. Verify with 'docker inspect <container>' that the effective labels contain crowdsec.enable=true

Example fix

// before (docker-compose.yml)
labels:
  - crowdsec.labels.type=syslog
// after
labels:
  - crowdsec.enable=true
  - crowdsec.labels.type=syslog

labels := container.Labels
if _, ok := labels["crowdsec.enable"]; !ok {
	return fmt.Errorf("container %s: crowdsec.enable label missing (got %v)", container.ID, labels)
}

func hasCrowdsecEnable(labels map[string]string) bool {
	_, ok := labels["crowdsec.enable"]
	return ok
}

if _, err := source.EvalContainer(ctx, ctr); err != nil {
	if err.Error() == "no crowdsec.enable key" {
		log.Warnf("container %s: add crowdsec.enable=true", ctr.ID)
	}
	// ignore other opt-out errors silently
}

When it happens

Trigger: EvalContainer or EvalService calls processCrowdsecLabels on an entity whose labels contain a crowdsec.* key (e.g. crowdsec.labels: ... ) but no 'enable' key, e.g. label 'crowdsec.labels' set without 'crowdsec.enable'.

Common situations: User adds crowdsec.labels to a docker-compose service to route logs but forgets crowdsec.enable=true; copy-pasted label blocks with the enable line dropped; templating that conditionally emits enable; typo like crowdsec.enabled or enable under the wrong prefix.

Related errors

• crowdsec.enable not true
• no labels key
• crowdsec.enable not a string
• labels not a map
• missing lapi client credentials

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0b1aa080787ff979. Report an issue: GitHub.