Docker Swarm Acquisition | CrowdSec | Page 1

nova rapids Mar 24, 2025, 5:21 PM

#

Hi 👋

I'm trying to get CrowdSec acquiring logs from various services I am running on Docker Swarm using container labels (https://doc.crowdsec.net/docs/next/log_processor/data_sources/docker/#use_container_labels), but I can't seem to get it to find any. I'm using docker-socket-proxy, and from those logs it doesn't look like the entire Swarm is being examined, only the local node.

Does CrowdSec not support Docker Swarm in this way?

Docker | CrowdSec

This module allows the Security Engine to acquire logs from running containers, in one-shot and streaming mode.

neon turretBOT Mar 24, 2025, 5:21 PM

#

Important Information

Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command /resolve or press the green resolve button below.

Log Files

If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.

Guide Followed (CrowdSec Official)

If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.

Screenshots

Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.

deft turtle Mar 24, 2025, 5:27 PM

#

nova rapids Hi 👋 I'm trying to get CrowdSec acquiring logs from various services I am ru...

I have never used swarm, but the docker acquisition can only access information that the local / docker-socket-proxy has access too. Since I dont know the in's and out's of swarm I guess there no "swarm" socket and it simply just contacts each socket individually to do deployments.

nova rapids Mar 24, 2025, 5:29 PM

#

Thanks - I had assumed that CrowdSec would work similarly to Traefik in this regard, but I guess Docker vs Swarm is a different API and CrowdSec doesn't integrate with the latter.

deft turtle Mar 24, 2025, 5:31 PM

#

nova rapids Thanks - I had assumed that CrowdSec would work similarly to Traefik in this reg...

is CrowdSec deployed on the management node? / how are you deploying it?

nova rapids Mar 24, 2025, 5:32 PM

#

Yes, both CrowdSec and docker-socket-proxy are limited to manager nodes

#

https://pastebin.com/wcSfnwmy has my partial docker-compose.yml file

Pastebin

crowdsec: image: crowdsecurity/crowdsec:v1.6.6 restart: unl...

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

#

And the acquis.yaml looks like this:

---
source: docker
use_container_labels: true
docker_host: tcp://traefik_dockerproxy:2375

deft turtle Mar 24, 2025, 5:40 PM

#

and traefik_dockerproxy is correct where does it get the traefik prefix?

#

cause I digged a little it seems the swarm api is identical to dockers just with nodes/swarm endpoints work which we dont need

nova rapids Mar 24, 2025, 5:42 PM

#

deft turtle and `traefik_dockerproxy` is correct where does it get the `traefik` prefix?

Yes, that's correct - it gets traefik_ from the stack. The proxy is being queried by CrowdSec - I can see this every second in the proxy logs:

::ffff:10.0.1.4:56992 [24/Mar/2025:17:40:57.902] dockerfrontend dockerbackend/dockersocket 0/0/0/2/2 200 32833 - - ---- 1/1/0/0/0 0/0 "GET /v1.43/containers/json HTTP/1.1"

::ffff:10.0.1.4:56992 [24/Mar/2025:17:40:57.905] dockerfrontend dockerbackend/dockersocket 0/0/0/0/0 200 7339 - - ---- 1/1/0/0/0 0/0 "GET /v1.43/containers/58040f96f57f8debbf463d500d8b6dbd2fdc25dbf96c1bd52773edfcf60422c1/json HTTP/1.1"

::ffff:10.0.1.4:56992 [24/Mar/2025:17:40:57.906] dockerfrontend dockerbackend/dockersocket 0/0/0/0/0 200 7903 - - ---- 1/1/0/0/0 0/0 "GET /v1.43/containers/c7d92617d3fac6b008e364c90d43e9d395bdc96946f73211f5f496607a3340b9/json HTTP/1.1"

...

#

That's repeated for ~12 containers, which are all on that local node, none of those are on other nodes

nova rapids Mar 24, 2025, 5:43 PM

#

deft turtle cause I digged a little it seems the swarm api is identical to dockers just with...

Interesting, maybe this is a problem with the proxy configuration rather than CrowdSec then?

deft turtle Mar 24, 2025, 5:44 PM

#

Well it might be "containers" is the local containers of the system and when swarm is active there on another endpoint

#

I need to see how traefik is doing it

#

but I gotta afk for now

nova rapids Mar 24, 2025, 5:45 PM

#

No worries, I'll see what I can find out and update. Thanks for the help so far

#

So from what I can tell from the Traefik source code, they do have two explicitly separate providers - one for Docker (https://github.com/traefik/traefik/blob/master/pkg/provider/docker/pdocker.go) and one for Swarm (https://github.com/traefik/traefik/blob/master/pkg/provider/docker/pswarm.go). It seems their Swarm provider uses Service labels rather than looking for individual Containers.

Unfortunately my knowledge of Go is non-existent, so I'm struggling to figure out much beyond that, but it sounds like my use case is probably not currently supported by CrowdSec?

GitHub

traefik/pkg/provider/docker/pdocker.go at master · traefik/traefik

The Cloud Native Application Proxy. Contribute to traefik/traefik development by creating an account on GitHub.

nova rapids Mar 25, 2025, 3:01 PM

#

For anyone who stumbles across this thread in future - I've opened a feature request here: https://github.com/crowdsecurity/crowdsec/issues/3540

GitHub

Add support for Docker Swarm · Issue #3540 · crowdsecurity/crowdsec

What would you like to be added? As per a discussion on Discord (https://discord.com/channels/921520481163673640/1353780808439042118) - it seems that the Docker container auto-discovery added in #2...

deft turtle Mar 25, 2025, 3:13 PM

#

nova rapids For anyone who stumbles across this thread in future - I've opened a feature req...

I did some late night reading into traefik codebase, it does seem you are on the right tracks about nodes vs containers. The only issue I see is currently we dont do any validation on the logging driver and we should also do this.

#

cause if the service has our labels and we cant read it then we should even try 😄

#Docker Swarm Acquisition