Container does not start with spaces in `ENROLL_INSTANCE_NAME`

[Stausssi]

What happened?

My container stopped working when setting the environment variable ENROLL_INSTANCE_NAME to a string with spaces:

Enroll this instance to https://app.crowdsec.net

You can get your enrollment key by creating an account on https://app.crowdsec.net.
After running this command your will need to validate the enrollment in the webapp.

Usage:
  cscli console enroll [enroll-key] [flags]

Examples:
cscli console enroll YOUR-ENROLL-KEY
cscli console enroll --name [instance_name] YOUR-ENROLL-KEY
cscli console enroll --name [instance_name] --tags [tag_1] --tags [tag_2] YOUR-ENROLL-KEY
cscli console enroll --enable console_management YOUR-ENROLL-KEY
cscli console enroll --disable context YOUR-ENROLL-KEY

valid options are : custom,manual,tainted,context,console_management,all (see 'cscli console status' for details)

Flags:
  -d, --disable strings   Disable console options
  -e, --enable strings    Enable console options
  -h, --help              help for enroll
  -n, --name string       Name to display in the console
      --overwrite         Force enroll the instance
  -t, --tags strings      Tags to display in the console

Global Flags:
      --color string    Output color: yes, no, auto (default "auto")
  -c, --config string   path to crowdsec config file (default "/etc/crowdsec/config.yaml")
      --debug           Set logging to debug
      --error           Set logging to error
      --info            Set logging to info
  -o, --output string   Output format: human, json, raw
      --trace           Set logging to trace
      --warning         Set logging to warning

Error: cscli console enroll: accepts 1 arg(s), received 2

What did you expect to happen?

It should escape the spaces without explicit quoting.

How can we reproduce it (as minimally and precisely as possible)?

Follow the Docker Quickstart and set ENROLL_INSTANCE_NAME=foo bar as well as ENROLL_KEY.

Anything else we need to know?

No response

Crowdsec version

Details

$ cscli version
version: v1.7.6-eacc8192
Codename: alphaga
BuildDate: 2026-01-23_15:55:06
GoVersion: 1.25.5
Platform: docker
libre2: C++
User-Agent: crowdsec/v1.7.6-eacc8192-docker
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: cscli_setup, datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite

OS version

Details

Running with Podman v4.9.3. on:

# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 24.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="24.04"
VERSION="24.04.3 LTS (Noble Numbat)"
VERSION_CODENAME=noble
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=noble
LOGO=ubuntu-logo
$ uname -a
Linux streaming 6.17.0-1007-oracle #7~24.04.1-Ubuntu SMP Tue Feb  3 22:09:11 UTC 2026 aarch64 aarch64 aarch64 GNU/Linux

Enabled collections and parsers

Details

$ cscli hub list -o raw
# paste output here

Acquisition config

Details

# On Linux:
$ cat /etc/crowdsec/acquis.yaml /etc/crowdsec/acquis.d/*
# paste output here

# On Windows:
C:\> Get-Content C:\ProgramData\CrowdSec\config\acquis.yaml
# paste output here

Config show

Details

$ cscli config show
# paste output here

Prometheus metrics

Details

$ cscli metrics
# paste output here

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

Details

[github-actions]

@Stausssi: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[LaurenceJJones]

I cant seem to replicate, from the output it seems it might be getting an empty string?

$ podman run -e "ENROLL_KEY=xxxx" -e "CROWDSEC_BYPASS_DB_VOLUME_CHECK=true" docker://crowdsecurity/crowdsec:v1.7.6
Populating configuration directory...
sending incremental file list
acquis.yaml
config.yaml
console.yaml
dev.yaml
local_api_credentials.yaml
online_api_credentials.yaml
profiles.yaml
simulation.yaml
user.yaml
acquis.d/
collections/
collections/linux.yaml -> /etc/crowdsec/hub/collections/crowdsecurity/linux.yaml
collections/sshd.yaml -> /etc/crowdsec/hub/collections/crowdsecurity/sshd.yaml
collections/whitelist-good-actors.yaml -> /etc/crowdsec/hub/collections/crowdsecurity/whitelist-good-actors.yaml
contexts/
contexts/bf_base.yaml -> /etc/crowdsec/hub/contexts/crowdsecurity/bf_base.yaml
hub/
hub/.index.json
hub/collections/
hub/collections/crowdsecurity/
hub/collections/crowdsecurity/linux.yaml
hub/collections/crowdsecurity/sshd.yaml
hub/collections/crowdsecurity/whitelist-good-actors.yaml
hub/contexts/
hub/contexts/crowdsecurity/
hub/contexts/crowdsecurity/bf_base.yaml
hub/parsers/
hub/parsers/s00-raw/
hub/parsers/s00-raw/crowdsecurity/
hub/parsers/s00-raw/crowdsecurity/syslog-logs.yaml
hub/parsers/s01-parse/
hub/parsers/s01-parse/crowdsecurity/
hub/parsers/s01-parse/crowdsecurity/sshd-logs.yaml
hub/parsers/s01-parse/crowdsecurity/sshd-success-logs.yaml
hub/parsers/s02-enrich/
hub/parsers/s02-enrich/crowdsecurity/
hub/parsers/s02-enrich/crowdsecurity/dateparse-enrich.yaml
hub/parsers/s02-enrich/crowdsecurity/geoip-enrich.yaml
hub/parsers/s02-enrich/crowdsecurity/public-dns-allowlist.yaml
hub/parsers/s02-enrich/crowdsecurity/whitelists.yaml
hub/postoverflows/
hub/postoverflows/s00-enrich/
hub/postoverflows/s00-enrich/crowdsecurity/
hub/postoverflows/s00-enrich/crowdsecurity/rdns.yaml
hub/postoverflows/s01-whitelist/
hub/postoverflows/s01-whitelist/crowdsecurity/
hub/postoverflows/s01-whitelist/crowdsecurity/cdn-whitelist.yaml
hub/postoverflows/s01-whitelist/crowdsecurity/seo-bots-whitelist.yaml
hub/scenarios/
hub/scenarios/crowdsecurity/
hub/scenarios/crowdsecurity/ssh-bf.yaml
hub/scenarios/crowdsecurity/ssh-cve-2024-6387.yaml
hub/scenarios/crowdsecurity/ssh-generic-test.yaml
hub/scenarios/crowdsecurity/ssh-refused-conn.yaml
hub/scenarios/crowdsecurity/ssh-slow-bf.yaml
hub/scenarios/crowdsecurity/ssh-time-based-bf.yaml
notifications/
notifications/email.yaml
notifications/file.yaml
notifications/http.yaml
notifications/sentinel.yaml
notifications/slack.yaml
notifications/splunk.yaml
parsers/
parsers/s00-raw/
parsers/s00-raw/syslog-logs.yaml -> /etc/crowdsec/hub/parsers/s00-raw/crowdsecurity/syslog-logs.yaml
parsers/s01-parse/
parsers/s01-parse/sshd-logs.yaml -> /etc/crowdsec/hub/parsers/s01-parse/crowdsecurity/sshd-logs.yaml
parsers/s01-parse/sshd-success-logs.yaml -> /etc/crowdsec/hub/parsers/s01-parse/crowdsecurity/sshd-success-logs.yaml
parsers/s02-enrich/
parsers/s02-enrich/dateparse-enrich.yaml -> /etc/crowdsec/hub/parsers/s02-enrich/crowdsecurity/dateparse-enrich.yaml
parsers/s02-enrich/geoip-enrich.yaml -> /etc/crowdsec/hub/parsers/s02-enrich/crowdsecurity/geoip-enrich.yaml
parsers/s02-enrich/public-dns-allowlist.yaml -> /etc/crowdsec/hub/parsers/s02-enrich/crowdsecurity/public-dns-allowlist.yaml
parsers/s02-enrich/whitelists.yaml -> /etc/crowdsec/hub/parsers/s02-enrich/crowdsecurity/whitelists.yaml
patterns/
patterns/aws
patterns/bacula
patterns/bro
patterns/cowrie_honeypot
patterns/exim
patterns/firewalls
patterns/haproxy
patterns/java
patterns/junos
patterns/linux-syslog
patterns/mcollective
patterns/modsecurity
patterns/mongodb
patterns/mysql
patterns/nagios
patterns/nginx
patterns/paths
patterns/postgresql
patterns/rails
patterns/redis
patterns/ruby
patterns/smb
patterns/ssh
patterns/tcpdump
postoverflows/
postoverflows/s00-enrich/
postoverflows/s00-enrich/rdns.yaml -> /etc/crowdsec/hub/postoverflows/s00-enrich/crowdsecurity/rdns.yaml
postoverflows/s01-whitelist/
postoverflows/s01-whitelist/cdn-whitelist.yaml -> /etc/crowdsec/hub/postoverflows/s01-whitelist/crowdsecurity/cdn-whitelist.yaml
postoverflows/s01-whitelist/seo-bots-whitelist.yaml -> /etc/crowdsec/hub/postoverflows/s01-whitelist/crowdsecurity/seo-bots-whitelist.yaml
scenarios/
scenarios/ssh-bf.yaml -> /etc/crowdsec/hub/scenarios/crowdsecurity/ssh-bf.yaml
scenarios/ssh-cve-2024-6387.yaml -> /etc/crowdsec/hub/scenarios/crowdsecurity/ssh-cve-2024-6387.yaml
scenarios/ssh-generic-test.yaml -> /etc/crowdsec/hub/scenarios/crowdsecurity/ssh-generic-test.yaml
scenarios/ssh-refused-conn.yaml -> /etc/crowdsec/hub/scenarios/crowdsecurity/ssh-refused-conn.yaml
scenarios/ssh-slow-bf.yaml -> /etc/crowdsec/hub/scenarios/crowdsecurity/ssh-slow-bf.yaml
scenarios/ssh-time-based-bf.yaml -> /etc/crowdsec/hub/scenarios/crowdsecurity/ssh-time-based-bf.yaml

sent 2,335,535 bytes  received 1,360 bytes  4,673,790.00 bytes/sec
total size is 2,329,391  speedup is 1.00
Error: no matches found
Generate local agent credentials
Machine 'localhost' successfully added to the local API.
API credentials written to '/etc/crowdsec/local_api_credentials.yaml'.
Check if lapi needs to register an additional agent
level=info msg="Successfully registered to Central API (CAPI)"
level=info msg="Central API credentials written to '/etc/crowdsec//online_api_credentials.yaml'"
Registration to online API done
level=info msg="manual set to true"
level=info msg="context set to true"
level=info msg="Enabled manual : Forward manual decisions to the console"
level=info msg="Enabled tainted : Forward alerts from tainted scenarios to the console"
level=info msg="Enabled context : Forward context with alerts to the console"
level=info msg="Watcher successfully enrolled. Visit https://app.crowdsec.net to accept it."
level=info msg="Please restart crowdsec after accepting the enrollment."
Skipping hub update, index file is not in a volume
Skipping hub upgrade, data directory is not in a volume
Running: cscli  parsers install "crowdsecurity/docker-logs"
Action plan:
📥 download
 parsers: crowdsecurity/docker-logs (0.1)
✅ enable
 parsers: crowdsecurity/docker-logs

downloading parsers:crowdsecurity/docker-logs
enabling parsers:crowdsecurity/docker-logs
Running: cscli  parsers install "crowdsecurity/cri-logs"
Action plan:
📥 download
 parsers: crowdsecurity/cri-logs (0.1)
✅ enable
 parsers: crowdsecurity/cri-logs

downloading parsers:crowdsecurity/cri-logs
enabling parsers:crowdsecurity/cri-logs
time="2026-02-24T13:35:55Z" level=info msg="Enabled feature flags: none"
time="2026-02-24T13:35:55Z" level=info msg="Crowdsec v1.7.6-eacc8192"
time="2026-02-24T13:35:55Z" level=info msg="Loading CAPI manager"
time="2026-02-24T13:35:55Z" level=info msg="CAPI manager configured successfully"
time="2026-02-24T13:35:55Z" level=error msg="Machine is not enrolled in the console, can't synchronize with the console"
time="2026-02-24T13:35:55Z" level=info msg="Start push to CrowdSec Central API (interval: 4s once, then 10s)"
time="2026-02-24T13:35:55Z" level=info msg="Start sending metrics to CrowdSec Central API (interval: 43m58s once, then 30m0s)"
time="2026-02-24T13:35:55Z" level=info msg="CrowdSec Local API listening on 0.0.0.0:8080"
time="2026-02-24T13:35:55Z" level=warning msg="scenario list is empty, will not pull yet"
time="2026-02-24T13:35:55Z" level=info msg="capi metrics: sending"
time="2026-02-24T13:35:55Z" level=info msg="Loading grok library /etc/crowdsec/patterns"
time="2026-02-24T13:35:56Z" level=info msg="Loading enrich plugins"
time="2026-02-24T13:35:56Z" level=info msg="Successfully registered enricher 'GeoIpCity'"
time="2026-02-24T13:35:56Z" level=info msg="Successfully registered enricher 'GeoIpASN'"
time="2026-02-24T13:35:56Z" level=info msg="Successfully registered enricher 'IpToRange'"
time="2026-02-24T13:35:56Z" level=info msg="Successfully registered enricher 'reverse_dns'"
time="2026-02-24T13:35:56Z" level=info msg="Successfully registered enricher 'ParseDate'"
time="2026-02-24T13:35:56Z" level=info msg="Successfully registered enricher 'UnmarshalJSON'"
time="2026-02-24T13:35:56Z" level=info msg="Loading parsers from 9 files"
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s00-raw/cri-logs.yaml stage=s00-raw
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s00-raw/docker-logs.yaml stage=s00-raw
time="2026-02-24T13:35:56Z" level=info msg="Loaded 2 parser nodes" file=/etc/crowdsec/parsers/s00-raw/syslog-logs.yaml stage=s00-raw
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/sshd-logs.yaml stage=s01-parse
time="2026-02-24T13:35:56Z" level=warning msg="grok 'IPv4_WORKAROUND' already registred" id=late-snowflake module=parser name=crowdsecurity/sshd-success-logs stage=s01-parse
time="2026-02-24T13:35:56Z" level=warning msg="grok 'IP_WORKAROUND' already registred" id=late-snowflake module=parser name=crowdsecurity/sshd-success-logs stage=s01-parse
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/sshd-success-logs.yaml stage=s01-parse
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/dateparse-enrich.yaml stage=s02-enrich
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml stage=s02-enrich
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/public-dns-allowlist.yaml stage=s02-enrich
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/whitelists.yaml stage=s02-enrich
time="2026-02-24T13:35:56Z" level=info msg="Loaded 10 nodes from 3 stages"
time="2026-02-24T13:35:56Z" level=info msg="Loading postoverflow parsers"
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/postoverflows/s00-enrich/rdns.yaml stage=s00-enrich
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/postoverflows/s01-whitelist/cdn-whitelist.yaml stage=s01-whitelist
time="2026-02-24T13:35:56Z" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/postoverflows/s01-whitelist/seo-bots-whitelist.yaml stage=s01-whitelist
time="2026-02-24T13:35:56Z" level=info msg="Loaded 3 nodes from 2 stages"
time="2026-02-24T13:35:56Z" level=info msg="Loading 6 scenario files"
time="2026-02-24T13:35:56Z" level=info msg="Adding trigger bucket" cfg=dry-tree name=crowdsecurity/ssh-generic-test
time="2026-02-24T13:35:56Z" level=info msg="Adding leaky bucket" cfg=spring-water name=crowdsecurity/ssh-slow-bf
time="2026-02-24T13:35:56Z" level=info msg="Adding leaky bucket" cfg=rough-bird name=crowdsecurity/ssh-slow-bf_user-enum
time="2026-02-24T13:35:56Z" level=info msg="Adding leaky bucket" cfg=broken-meadow name=crowdsecurity/ssh-cve-2024-6387
time="2026-02-24T13:35:56Z" level=info msg="Adding leaky bucket" cfg=wispy-star name=crowdsecurity/ssh-bf
time="2026-02-24T13:35:56Z" level=info msg="Adding leaky bucket" cfg=green-grass name=crowdsecurity/ssh-bf_user-enum
time="2026-02-24T13:35:56Z" level=info msg="Adding conditional bucket" cfg=summer-brook name=crowdsecurity/ssh-time-based-bf
time="2026-02-24T13:35:56Z" level=info msg="Adding conditional bucket" cfg=patient-wildflower name=crowdsecurity/ssh-time-based-bf_user-enum
time="2026-02-24T13:35:56Z" level=info msg="Adding trigger bucket" cfg=divine-night name=crowdsecurity/ssh-refused-conn
time="2026-02-24T13:35:56Z" level=info msg="Loaded 9 scenarios"
time="2026-02-24T13:35:56Z" level=info msg="127.0.0.1 - [Tue, 24 Feb 2026 13:35:56 UTC] \"POST /v1/watchers/login HTTP/1.1 200 73.52658ms \"crowdsec/v1.7.6-eacc8192-docker\" \"" module=lapi
time="2026-02-24T13:35:56Z" level=info msg="loading acquisition file : /etc/crowdsec/acquis.yaml"
time="2026-02-24T13:35:56Z" level=info msg="Configuring datasource" module=acquisition.file type=file
time="2026-02-24T13:35:56Z" level=warning msg="No matching files for pattern /does/not/exist" module=acquisition.file type=file
time="2026-02-24T13:35:56Z" level=info msg="Starting parser routine" idx=0
time="2026-02-24T13:35:56Z" level=info msg="Starting bucket routine" idx=0
time="2026-02-24T13:35:56Z" level=info msg="Starting output routine" idx=0
time="2026-02-24T13:35:56Z" level=info msg="Starting processing data"
time="2026-02-24T13:35:56Z" level=info msg="127.0.0.1 - [Tue, 24 Feb 2026 13:35:56 UTC] \"POST /v1/usage-metrics HTTP/1.1 201 5.57561ms \"crowdsec/v1.7.6-eacc8192-docker\" \"" module=lapi
time="2026-02-24T13:35:56Z" level=info msg="Starting community-blocklist update"
time="2026-02-24T13:35:57Z" level=info msg="capi/community-blocklist : 0 explicit deletions"
time="2026-02-24T13:35:57Z" level=warning msg="sqlite is not using WAL mode, LAPI might become unresponsive when inserting the community blocklist"
time="2026-02-24T13:35:57Z" level=info msg="crowdsecurity/community-blocklist : added 15000 entries, deleted 0 entries (alert:1)"
time="2026-02-24T13:35:57Z" level=info msg="Start pull from CrowdSec Central API (interval: 2h4m36s once, then 2h0m0s)"

it came alive and managed to enroll into my account

[LaurenceJJones]

Wait I didnt see Error: cscli console enroll: accepts 1 arg(s), received 2 do you have any spaces or how is it defined in compose?

[Stausssi]

My bad for not double-checking before reporting, sorry! There is no space in ENROLL_KEY but it is in fact caused by ENROLL_INSTANCE_NAME=<name with spaces>:

podman run -e "ENROLL_KEY=xxxx" -e "ENROLL_INSTANCE_NAME=foo bar" -e "CROWDSEC_BYPASS_DB_VOLUME_CHECK=true" docker://crowdsecurity/crowdsec:v1.7.6

Should I update the issue title and description?

[LaurenceJJones]

Ahh yeah that'll do it cause the name is not wrapped in quotes.

Yes please.