crowdsecurity/crowdsec · error

while parsing DockerAcquisition configuration: %s

Error message

while parsing DockerAcquisition configuration: %s

What it means

UnmarshalConfig decodes the docker datasource YAML with yaml.Strict(), which rejects any unknown or mistyped field. On failure the error is wrapped as `while parsing DockerAcquisition configuration: <formatted error>`. The datasource cannot be configured and acquisition of that source fails.

Source

Thrown at pkg/acquisition/modules/docker/config.go:60

func (dc *Configuration) hasServiceConfig() bool {
	return len(dc.ServiceName) > 0 || len(dc.ServiceID) > 0 ||
		len(dc.ServiceIDRegexp) > 0 || len(dc.ServiceNameRegexp) > 0 || dc.UseServiceLabels
}

func (dc *Configuration) hasContainerConfig() bool {
	return len(dc.ContainerName) > 0 || len(dc.ContainerID) > 0 ||
		len(dc.ContainerIDRegexp) > 0 || len(dc.ContainerNameRegexp) > 0 || dc.UseContainerLabels
}

func (d *Source) UnmarshalConfig(yamlConfig []byte) error {
	d.Config = Configuration{
		FollowStdout: true, // default
		FollowStdErr: true, // default
	}

	if err := yaml.UnmarshalWithOptions(yamlConfig, &d.Config, yaml.Strict()); err != nil {
		return fmt.Errorf("while parsing DockerAcquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if d.logger != nil {
		d.logger.Tracef("DockerAcquisition configuration: %+v", d.Config)
	}

	// Check if we have any container or service configuration
	if !d.Config.hasContainerConfig() && !d.Config.hasServiceConfig() {
		return errors.New("no containers or services configuration provided")
	}

	if d.Config.UseContainerLabels && (len(d.Config.ContainerName) > 0 || len(d.Config.ContainerID) > 0 || len(d.Config.ContainerIDRegexp) > 0 || len(d.Config.ContainerNameRegexp) > 0) {
		return errors.New("use_container_labels and container_name, container_id, container_id_regexp, container_name_regexp are mutually exclusive")
	}

	if d.Config.UseServiceLabels && (len(d.Config.ServiceName) > 0 || len(d.Config.ServiceID) > 0 || len(d.Config.ServiceIDRegexp) > 0 || len(d.Config.ServiceNameRegexp) > 0) {
		return errors.New("use_service_labels and service_name, service_id, service_id_regexp, service_name_regexp are mutually exclusive")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the formatted error: yaml.FormatError names the exact offending field and line
2. Remove or rename the unknown/misspelled key to one supported by the docker datasource (follow_stdout, follow_stderr, container_name_regexp, container_id, docker_host, mode, etc.)
3. Fix value types to match the struct (booleans as true/false, string lists for regexps)

Example fix

// before
source: docker
  container_name: myapp
// after
source: docker
  container_name_regexp:
    - myapp

var raw map[string]interface{}
if err := yaml.Unmarshal(yamlBlock, &raw); err != nil { return err }
known := map[string]bool{"mode":true,"docker_host":true,"follow_stdout":true,"follow_stderr":true,"container_name_regexp":true,"container_id":true,"check_all":true,"force_inotify":true}
for k := range raw { if !known[k] { return fmt.Errorf("unknown docker key %q", k) } }

if err := ds.UnmarshalConfig(yamlConfig); err != nil {
    // yaml.FormatError output names the offending line/field — surface it to the operator
    return fmt.Errorf("acquisition config rejected: %v", err)
}

When it happens

Trigger: An acquisition YAML for the docker datasource contains a key not present in the Configuration struct (e.g. `container_name:` instead of `container_name_regexp:`), a wrong-typed value, or a duplicate key — all rejected by strict unmarshalling.

Common situations: Copying config from another datasource type; old config keys removed in newer crowdsec versions; indentation mistakes creating unexpected keys; boolean fields given string values.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• empty file
• unsupported mode %s for docker datasource
• container_name_regexp: %w
• container_id_regexp: %w
• service_name_regexp: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/548307f45437e2e6. Report an issue: GitHub.