crowdsecurity/crowdsec · error

use_service_labels and service_name, service_id, service_id_

Error message

use_service_labels and service_name, service_id, service_id_regexp, service_name_regexp are mutually exclusive

What it means

Validation guard in docker UnmarshalConfig: use_service_labels is enabled alongside explicit service selectors (service_name, service_id, service_id_regexp, service_name_regexp). As with containers, discovering swarm services by label and naming them explicitly are mutually exclusive configuration styles.

Source

Thrown at pkg/acquisition/modules/docker/config.go:77

	if err := yaml.UnmarshalWithOptions(yamlConfig, &d.Config, yaml.Strict()); err != nil {
		return fmt.Errorf("while parsing DockerAcquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if d.logger != nil {
		d.logger.Tracef("DockerAcquisition configuration: %+v", d.Config)
	}

	// Check if we have any container or service configuration
	if !d.Config.hasContainerConfig() && !d.Config.hasServiceConfig() {
		return errors.New("no containers or services configuration provided")
	}

	if d.Config.UseContainerLabels && (len(d.Config.ContainerName) > 0 || len(d.Config.ContainerID) > 0 || len(d.Config.ContainerIDRegexp) > 0 || len(d.Config.ContainerNameRegexp) > 0) {
		return errors.New("use_container_labels and container_name, container_id, container_id_regexp, container_name_regexp are mutually exclusive")
	}

	if d.Config.UseServiceLabels && (len(d.Config.ServiceName) > 0 || len(d.Config.ServiceID) > 0 || len(d.Config.ServiceIDRegexp) > 0 || len(d.Config.ServiceNameRegexp) > 0) {
		return errors.New("use_service_labels and service_name, service_id, service_id_regexp, service_name_regexp are mutually exclusive")
	}

	if d.Config.CheckInterval != "" && d.logger != nil {
		d.logger.Warn("check_interval is ignored: this datasource now uses events instead of polling (will be removed in a future version)")
	}

	if d.Config.Mode == "" {
		d.Config.Mode = configuration.TAIL_MODE
	}

	if d.Config.Mode != configuration.CAT_MODE && d.Config.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %s for docker datasource", d.Config.Mode)
	}

	for _, cont := range d.Config.ContainerNameRegexp {
		compiled, err := regexp.Compile(cont)
		if err != nil {
			return fmt.Errorf("container_name_regexp: %w", err)

View on GitHub (pinned to 909b515798)

Solutions

1. Choose one strategy: use_service_labels: true with no service_* fields, or explicit service_* lists with the toggle off
2. Label-based service discovery suits dynamic swarm clusters; explicit lists suit fixed service topologies

When it happens

Trigger: Thrown at pkg/acquisition/modules/docker/config.go:77 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/61241f700ad555ed. Report an issue: GitHub.