From dbe6877029191c8950d0a5b55651174777e8f696 Mon Sep 17 00:00:00 2001 From: hamodywe Date: Sun, 16 Aug 2026 06:04:26 +0300 Subject: [PATCH] fix(docker): honor DISABLE_* hub knobs when the agent is disabled The default hub items are copied into /etc/crowdsec by the staging step, which is not gated on DISABLE_AGENT. The knobs that remove them live in prepare_hub(), which returns early when the agent is disabled. So a LAPI-only container (DISABLE_AGENT=true) keeps the collections it was explicitly told to drop: DISABLE_COLLECTIONS=crowdsecurity/linux has no effect, and the collection stays listed in cscli collections list. Move the removal block into remove_hub_items() and call it on the paths that return early, so removal follows the same rule as the copy it is meant to undo. Installing hub items still requires the agent, so that path is unchanged. Fixes #4563 Signed-off-by: hamodywe --- build/docker/docker_start.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/build/docker/docker_start.sh b/build/docker/docker_start.sh index 9939c6ad308..6ccb3d13a8e 100755 --- a/build/docker/docker_start.sh +++ b/build/docker/docker_start.sh @@ -205,11 +205,17 @@ difference() { # prepare_hub updates/installs/removes Hub items based on env vars, but only when the agent is expected to run. # It exits early when the agent is disabled with DISABLE_AGENT or in the configuration. prepare_hub() { + # The default hub items are copied from /staging regardless of the agent + # (see the rsync in the staging step), so the DISABLE_* knobs have to be + # honored even when no agent runs - otherwise a LAPI-only container keeps + # collections it was explicitly told to drop. if istrue "$DISABLE_AGENT"; then + remove_hub_items return fi if conf_get '.crowdsec_service ?= null or (.crowdsec_service.enable? == false)' >/dev/null 2>&1; then + remove_hub_items return fi @@ -256,6 +262,10 @@ prepare_hub() { cscli_if_clean appsec-rules install "$(difference "$APPSEC_RULES" "$DISABLE_APPSEC_RULES")" fi + remove_hub_items +} + +remove_hub_items() { ## Remove collections, parsers, scenarios & postoverflows if [ "$DISABLE_COLLECTIONS" != "" ]; then # shellcheck disable=SC2086