crowdsecurity/crowdsec · error

%w (path length exceeds system limit: %d > %d)

Error message

%w (path length exceeds system limit: %d > %d)

What it means

WrapSockErr decorates socket errors with an extra message when the unix socket path exceeds the OS's sun_path limit (108 chars on Linux, 104 on BSD/macOS — Go doesn't export them so they're hardcoded). A too-long socket path fails at bind time with EINVAL/'invalid argument'; this wrapper turns the cryptic error into one that names the length and the limit.

Source

Thrown at pkg/csnet/socket.go:20

import (
	"fmt"
	"runtime"
)

// WrapSockErr wraps the provided error with a possible cause if the unix socket path exceeds
// a system-specific maximum length. It returns the original error otherwise.
func WrapSockErr(err error, socket string) error {
	limit := 0
	switch runtime.GOOS {
	case "linux":
		// the actual numbers are not exported in Go, so we hardcode them
		limit = 108
	case "freebsd", "darwin", "openbsd":
		limit = 104
	}
	if limit > 0 && len(socket) > limit {
		return fmt.Errorf("%w (path length exceeds system limit: %d > %d)", err, len(socket), limit)
	}
	return err
}

View on GitHub (pinned to 909b515798)

Solutions

1. Shorten the unix socket path in the config: use a short directory like /run/crowdsec/ or /var/run/ for the socket.
2. Move the socket dir to a symlinked short path if you cannot relocate the data (bind the socket at a short path).
3. Reduce the socket filename length if the directory path is already near the limit.
4. Switch the LAPI client to connect via TCP (host/port) instead of a unix socket when path shortening is impossible.

Example fix

// before (config.yaml)
api:
  server:
    socket: /very/long/deep/install/prefix/with/many/nested/directories/that/exceeds/the/limit/crowdsec.sock
// after
api:
  server:
    socket: /run/crowdsec/crowdsec.sock

const linuxSunPath = 108
if len(socketPath) >= linuxSunPath {
    return fmt.Errorf("socket path %q too long (%d >= %d); use a shorter path", socketPath, len(socketPath), linuxSunPath)
}

if err := broker.Listen(); err != nil {
    if strings.Contains(err.Error(), "path length exceeds system limit") {
        // reconfigure the socket to /run/crowdsec/ or fall back to TCP
    }
    return err
}

When it happens

Trigger: The LAPI unix socket path derived from the configured lapi unix socket dir + filename exceeds the OS limit — e.g. long install prefixes or long docker volume paths used in api.client.insecure_skip_verify / unix socket config.

Common situations: CrowdSec installed under a deep path (long --prefix builds), container mounts like /var/lib/.../long-hash-directory/crowdsec.sock, or macOS/FreeBSD installs where the 104-char limit bites even on moderately long paths.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• error connecting to websocket
• cannot use TLS with a unix socket
• while describing group %s: %w
• while reading %s/%s: %w
• while reading logs from %s/%s: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/cf207dacd559d3f4. Report an issue: GitHub.