crowdsecurity/crowdsec · error

no crowdsec labels

Error message

no crowdsec labels

What it means

Returned by processCrowdsecLabels (called from EvalContainer/EvalService) when the parsed labels map is empty: the container or swarm service carries no 'crowdsec' labels (e.g. crowdsec.type), so there is nothing to derive acquisition labels from. It is largely informational — the caller uses it to decide to ignore the container for label-driven acquisition.

Source

Thrown at pkg/acquisition/modules/docker/source.go:81

		return false
	}

	return containerDetails.Container.Config.Tty
}

func (d *Source) getContainerLabels(ctx context.Context, containerID string) map[string]any {
	containerDetails, err := d.Client.ContainerInspect(ctx, containerID, client.ContainerInspectOptions{})
	if err != nil {
		return map[string]any{}
	}

	return parseLabels(containerDetails.Container.Config.Labels)
}

func (d *Source) processCrowdsecLabels(parsedLabels map[string]any, entityID string, entityType string) (map[string]string, error) {
	if len(parsedLabels) == 0 {
		d.logger.Tracef("%s has no 'crowdsec' labels set, ignoring %s: %s", entityType, entityType, entityID)
		return nil, errors.New("no crowdsec labels")
	}

	if _, ok := parsedLabels["enable"]; !ok {
		d.logger.Errorf("%s has 'crowdsec' labels set but no 'crowdsec.enable' key found", entityType)
		return nil, errors.New("no crowdsec.enable key")
	}

	enable, ok := parsedLabels["enable"].(string)
	if !ok {
		d.logger.Errorf("%s has 'crowdsec.enable' label set but it's not a string", entityType)
		return nil, errors.New("crowdsec.enable not a string")
	}

	if strings.ToLower(enable) != "true" {
		d.logger.Debugf("%s has 'crowdsec.enable' label not set to true ignoring %s: %s", entityType, entityType, entityID)
		return nil, errors.New("crowdsec.enable not true")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. If the container should be watched via labels, add labels such as crowdsec.type=nginx to its compose/service definition
2. If you select containers explicitly with container_name etc., this error is expected for unlabeled neighbors and can be ignored
3. Check the label namespace spelling — only labels under the crowdsec. prefix are considered

When it happens

Trigger: Thrown at pkg/acquisition/modules/docker/source.go:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/26fd22b49f9007c8. Report an issue: GitHub.