Dependency failed to start: container crowdsec is unhealthy

[Jason-Keller]

Describe the Bug

Hello all,

I was updating my Pangolin stack via SSHing into my VPS, running the command sudo docker compose down, then sudo docker compose pull and finally sudo docker compose up -d.

All seemed to go well until the console spit out the following error:

root@switchboard:~# sudo docker compose up -d
WARN[0000] No services to build
[+] up 5/5
✔ Network pangolin Created 0.1s
✔ Container pangolin Healthy 22.4s
✘ Container crowdsec Error dependency crowdsec failed to start 22.5s
✔ Container gerbil Created 0.0s
✔ Container traefik Created 0.1s
dependency failed to start: container crowdsec is unhealthy

Seems everything in the stack runs except Crowdsec, which is preventing other things from working. Here are the logs I pulled from Crowdsec via sudo docker compose logs crowdsec :

root@switchboard:~# docker compose logs crowdsec crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:01:31Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:01:31Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:01:31Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:01:31Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:01:32Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:01:32Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:01:32Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:01:42Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:01:42Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:01:42Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:01:42Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:01:42Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:01:43Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:01:43Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:01:52Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:01:52Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:01:52Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:01:53Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:01:53Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:01:53Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:01:53Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:02:04Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:02:04Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:02:04Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:02:04Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:02:04Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:02:04Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:02:04Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:02:14Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:02:14Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:02:14Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:02:15Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:02:15Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:02:15Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:02:15Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:02:24Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:02:24Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:02:25Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:02:25Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:02:25Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:02:25Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:02:25Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:02:35Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:02:35Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:02:35Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:02:35Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:02:35Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:02:36Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:02:36Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:02:45Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:02:45Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:02:45Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:02:45Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:02:46Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:02:46Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:02:46Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:02:55Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:02:55Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:02:55Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:02:56Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:02:56Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:02:56Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:02:56Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:03:07Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:03:07Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:03:07Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:03:08Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:03:08Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:03:08Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:03:08Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:03:17Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:03:17Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:03:17Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:03:17Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:03:18Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:03:18Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:03:18Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:03:27Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:03:27Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:03:27Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:03:28Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:03:28Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:03:28Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:03:28Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:03:37Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:03:37Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:03:37Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:03:38Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:03:38Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:03:38Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:03:38Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:03:48Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:03:48Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:03:48Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:03:48Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:03:48Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:03:49Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:03:49Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:03:59Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:03:59Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:03:59Z" level=info msg="Loading CAPI manager" crowdsec | time="2026-01-19T01:04:00Z" level=info msg="attempt 1 out of 2" crowdsec | time="2026-01-19T01:04:00Z" level=info msg="attempt 2 out of 2" crowdsec | time="2026-01-19T01:04:00Z" level=info msg="max attempts reached for status code 403" crowdsec | time="2026-01-19T01:04:00Z" level=fatal msg="api server init: unable to run local API: authenticate watcher (a0466794c3dd4217abd78e299acbc81cMhyQou339ihxslYE): API error: Forbidden" root@switchboard:~# root@switchboard:~# docker compose logs crowdsec crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Local agent already registered crowdsec | Check if lapi needs to register an additional agent crowdsec | sqlite database permissions updated crowdsec | /etc/crowdsec was found in a volume crowdsec | Running hub update crowdsec | level=warning msg="Failed to check last modified: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" crowdsec | Downloading /etc/crowdsec/hub/.index.json crowdsec | Error: cscli hub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true crowdsec | /var/lib/crowdsec/data was found in a volume crowdsec | Running hub upgrade crowdsec | level=info msg="parsers:crowdsecurity/whitelists - not downloading local item" crowdsec | Action plan: crowdsec | 🔄 check & update data files crowdsec | crowdsec | Running: cscli parsers install "crowdsecurity/docker-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli parsers install "crowdsecurity/cri-logs" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/traefik" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-virtual-patching" crowdsec | Nothing to install or remove. crowdsec | Running: cscli collections install "crowdsecurity/appsec-generic-rules" crowdsec | Nothing to install or remove. crowdsec | Object parsers/crowdsecurity/whitelists is local, skipping crowdsec | time="2026-01-19T01:01:31Z" level=info msg="Enabled feature flags: none" crowdsec | time="2026-01-19T01:01:31Z" level=info msg="Crowdsec v1.7.4-db3efdbf" crowdsec | time="2026-01-19T01:01:31Z" level=info msg="Loading CAPI manager" crowdsec | /var/lib/cro^Cub update: failed to update hub: bad HTTP code 403 for https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=truerue" url="https://cdn-hub.crowdsec.net/crowdsecurity/master/.index.json?with_content=true" root@switchboard:~#

I'm sorry if this is simple/something I'm missing. I've been looking around trying to see the issue within the config.yml for Crowdsec, but nothing jumps out at me aside froim the 403 error when connecting to something on Crowdsec's website...

Please let me know if I've missed anything obvious, or if you need more information.

Thank you!

Environment

• OS Type & Version: Ubuntu 22.04.5 LTS Jammy JellyFish on VPS
• Pangolin Version: Latest
• Gerbil Version: Latest
• Traefik Version: Latest
• Newt Version: Latest
• Olm Version: N/A

To Reproduce

All I did was update by stopping the stack, pulling, and starting again.

Expected Behavior

Smooth update of Crowdsec.

[Jason-Keller]

I... am not sure why the formatting is like that. I've tried appending the markup to each line of output, and then I also tried appending to each end of large chunks of output. Seems it all comes out the same. My apologies guys. Here's a .txt file of the Crowdsec logs attached!

crowdsec compose logs.txt

[Jason-Keller]

Followed instructions from this thread about the 403 issue, still happening to me.