[BUG] swag-crowdsec: version mismatch in lua module with swag:5.3.0 causes [emerg] and failure to start

[kennyboy55]

Is there an existing issue for this?

• I have searched the existing issues

Name of mod

linuxserver/mods:swag-crowdsec

Name of base container

linuxserver/swag

Current Behavior

After updating swag to 5.3.0, the entire container fails to start and spams the following error over and over:
swag | 2026/02/05 19:24:53 [emerg] 1493#1493: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1

Downgrading back to swag 5.2.2 does not fix the issue, but removing the swag-crowdsec mod does.

Expected Behavior

swag starts without error and functions even with the crowdsec mod.

Steps To Reproduce

1. SWAG 5.3.0 (latest) with swag-crowdsec mod
2. Start container
3. Fails

Environment

- OS: Debian 13 trixie
- How docker service was installed: apt source list

CPU architecture

x86-64

Docker creation

services:
  swag:
    image: ghcr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    env_file: swag.env
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Amsterdam
      - DOCKER_MODS=linuxserver/mods:swag-dashboard|ghcr.io/themepark-dev/theme.park:swag|linuxserver/mods:swag-crowdsec
    volumes:
      - ./config:/config
    ports:
      - 443:443
    restart: unless-stopped

  crowdsec:
    image: ghcr.io/crowdsecurity/crowdsec:latest
    container_name: crowdsec
    env_file: crowdsec.env
    environment:
      - GID=1000
    volumes:
      - ./crowdsec/config:/etc/crowdsec:rw
      - ./crowdsec/data:/var/lib/crowdsec/data:rw
      - ./config/log/nginx:/var/log/swag:ro
      - /var/log:/var/log/host:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    depends_on:
      swag:
    security_opt:
      - no-new-privileges=true

Container logs

Container swag Creating 
 Container swag Created 
Attaching to swag
 Container swag Starting 
 Container swag Started 
swag  | [mod-init] Running Docker Modification Logic
swag  | [mod-init] Adding linuxserver/mods:swag-dashboard to container
swag  | [mod-init] Downloading linuxserver/mods:swag-dashboard from lscr.io
swag  | [mod-init] Installing linuxserver/mods:swag-dashboard
swag  | [mod-init] linuxserver/mods:swag-dashboard applied to container
swag  | [mod-init] Adding themepark-dev/theme.park:swag to container
swag  | [mod-init] Downloading themepark-dev/theme.park:swag from ghcr.io
swag  | [mod-init] Installing themepark-dev/theme.park:swag
swag  | [mod-init] themepark-dev/theme.park:swag applied to container
swag  | [mod-init] Adding linuxserver/mods:swag-crowdsec to container
swag  | [mod-init] Downloading linuxserver/mods:swag-crowdsec from lscr.io
swag  | [mod-init] Installing linuxserver/mods:swag-crowdsec
swag  | [mod-init] linuxserver/mods:swag-crowdsec applied to container
swag  | [migrations] started
swag  | [migrations] 01-nginx-site-confs-default: skipped
swag  | [migrations] 02-swag-old-certbot-paths: skipped
swag  | [migrations] done
swag  | ───────────────────────────────────────
swag  | 
swag  |       ██╗     ███████╗██╗ ██████╗
swag  |       ██║     ██╔════╝██║██╔═══██╗
swag  |       ██║     ███████╗██║██║   ██║
swag  |       ██║     ╚════██║██║██║   ██║
swag  |       ███████╗███████║██║╚██████╔╝
swag  |       ╚══════╝╚══════╝╚═╝ ╚═════╝
swag  | 
swag  |    Brought to you by linuxserver.io
swag  | ───────────────────────────────────────
swag  | 
swag  | To support the app dev(s) visit:
swag  | Certbot: https://supporters.eff.org/donate/support-work-on-certbot
swag  | 
swag  | To support LSIO projects visit:
swag  | https://www.linuxserver.io/donate/
swag  | 
swag  | ───────────────────────────────────────
swag  | GID/UID
swag  | ───────────────────────────────────────
swag  | 
swag  | User UID:    1000
swag  | User GID:    1000
swag  | ───────────────────────────────────────
swag  | Linuxserver.io version: 5.3.0-ls436
swag  | Build-date: 2026-02-03T19:48:44+00:00
swag  | ───────────────────────────────────────
swag  |     
swag  | using keys found in /config/keys
swag  | **** The following active confs have different version dates than the samples that are shipped. ****
swag  | **** This may be due to user customization or an update to the samples. ****
swag  | **** You should compare the following files to the samples in the same folder and update them. ****
swag  | **** Use the link at the top of the file to view the changelog. ****
swag  | ┌────────────┬────────────┬────────────────────────────────────────────────────────────────────────┐
swag  | │  old date  │  new date  │ path                                                                   │
swag  | ├────────────┼────────────┼────────────────────────────────────────────────────────────────────────┤
swag  | │ 2024-03-14 │ 2025-03-25 │ /config/nginx/authelia-location.conf                                   │
swag  | │ 2024-03-16 │ 2025-03-25 │ /config/nginx/authelia-server.conf                                     │
swag  | │ 2023-04-27 │ 2025-03-25 │ /config/nginx/authentik-server.conf                                    │
swag  | │ 2024-12-17 │ 2025-07-18 │ /config/nginx/site-confs/default.conf                                  │
<redacted>
swag  | └────────────┴────────────┴────────────────────────────────────────────────────────────────────────┘
swag  | **** The following site-confs have extensions other than .conf ****
swag  | **** This may be due to user customization. ****
swag  | **** You should review the files and rename them to use the .conf extension or remove them. ****
swag  | **** nginx.conf will only include site-confs with the .conf extension. ****
swag  | /config/nginx/site-confs/default.conf.backup
swag  | /config/nginx/site-confs/default.conf.save
swag  | Variables set:
swag  | PUID=1000
swag  | PGID=1000
swag  | TZ=Europe/Amsterdam
swag  | URL=<redacted>
swag  | SUBDOMAINS=wildcard
swag  | EXTRA_DOMAINS=<redacted>
swag  | ONLY_SUBDOMAINS=false
swag  | VALIDATION=dns
swag  | CERTPROVIDER=zerossl
swag  | DNSPLUGIN=cloudflare
swag  | EMAIL=<redacted>
swag  | STAGING=false
swag  | 
swag  | ZeroSSL is selected as the cert provider, registering cert with <redacted>
swag  | SUBDOMAINS entered, processing
swag  | Wildcard cert for <redacted> will be requested
swag  | EXTRA_DOMAINS entered, processing
swag  | Extra domains processed are: <redacted>
swag  | E-mail address entered: <redacted>
swag  | dns validation via cloudflare plugin is selected
swag  | Certificate exists; parameters unchanged; starting nginx
swag  | The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am).
swag  | /config/nginx/ldap.conf exists.
swag  |         Please apply any customizations to /config/nginx/ldap-server.conf
swag  |         Ensure your configs are updated and remove /config/nginx/ldap.conf
swag  |         If you do not use this config, simply remove it.
swag  | **** Configuring CrowdSec nginx Bouncer ****
swag  | **** Applying the SWAG dashboard mod... ****
swag  | -------------------------
swag  | |  SWAG theme.park Mod  |
swag  | -------------------------
swag  | Variables set:
swag  | 'TP_BRANCH'=
swag  | 
swag  | No branch set, defaulting to live
swag  | **** Adding goaccess to package install list ****
swag  | **** libmaxminddb already installed, skipping ****
swag  | **** The swag-dashboard conf has been updated ****
swag  | **** Compare the changes using the sample file: /config/nginx/proxy-confs/dashboard.subdomain.conf.sample
swag  | **** Applied the SWAG dashboard mod ****
swag  | **** Successfully configured CrowdSec nginx Bouncer  ****
swag  | [pkg-install-init] **** Installing all mod packages ****
swag  | fetch http://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
swag  | fetch http://dl-cdn.alpinelinux.org/alpine/v3.22/community/x86_64/APKINDEX.tar.gz
swag  | (1/17) Installing gettext-envsubst (0.24.1-r0)
swag  | (2/17) Installing libgomp (14.2.0-r6)
swag  | (3/17) Installing gettext-libs (0.24.1-r0)
swag  | (4/17) Installing gettext (0.24.1-r0)
swag  | (5/17) Installing goaccess (1.9.4-r0)
swag  | (6/17) Installing lua5.1-libs (5.1.5-r13)
swag  | (7/17) Installing lua5.1 (5.1.5-r13)
swag  | (8/17) Installing lua-resty-http (0.17.2-r0)
swag  | (9/17) Installing luajit (2.1_p20240815-r1)
swag  | (10/17) Installing lua-resty-lrucache (0.13-r1)
swag  | (11/17) Installing lua-resty-core (0.1.31-r0)
swag  | (12/17) Installing nginx-mod-http-lua (1.28.2-r0)
swag  | (13/17) Installing lua-resty-string (0.15-r0)
swag  | (14/17) Installing lua-sec (1.3.2-r0)
swag  | (15/17) Installing lua5.1-socket (3.1.0-r1)
swag  | (16/17) Installing lua5.1-sec (1.3.2-r0)
swag  | (17/17) Installing lua5.1-cjson (2.1.0-r11)
swag  | Executing busybox-1.37.0-r20.trigger
swag  | OK: 196 MiB in 238 packages
swag  | [custom-init] No custom files found, skipping...
swag  | Auto-reload: Watching the following folders for changes to .conf files:
swag  | /config/nginx
swag  | [ls.io-init] done.
swag  | 2026/02/05 19:50:12 [emerg] 1188#1188: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:14 [emerg] 1229#1229: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:15 [emerg] 1234#1234: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:16 [emerg] 1239#1239: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:17 [emerg] 1244#1244: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:18 [emerg] 1256#1256: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:19 [emerg] 1261#1261: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:20 [emerg] 1266#1266: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:21 [emerg] 1271#1271: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:22 [emerg] 1276#1276: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:23 [emerg] 1288#1288: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:24 [emerg] 1293#1293: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:25 [emerg] 1298#1298: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:26 [emerg] 1303#1303: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:27 [emerg] 1308#1308: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:28 [emerg] 1320#1320: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:29 [emerg] 1325#1325: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:30 [emerg] 1330#1330: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:31 [emerg] 1335#1335: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:32 [emerg] 1340#1340: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:33 [emerg] 1352#1352: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:34 [emerg] 1357#1357: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:35 [emerg] 1362#1362: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:36 [emerg] 1367#1367: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:37 [emerg] 1372#1372: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
swag  | 2026/02/05 19:50:38 [emerg] 1384#1384: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1
 Compose Stopping Gracefully Stopping... press Ctrl+C again to force
 Container swag Stopping 
 Container swag Stopped

[thespad]

Most likely an upstream packaging issue with Alpine's lua modules that'll get fixed on its own but I'll have a look

[kennyboy55]

I managed to work around it for now. It is indeed caused by the crowdsec mod installing the latest 1.28.2 version of a module, while the main swag container is still at 1.28.0.

I fixed it temporarily while the main image gets updated.

1. Update swag to the problematic version, and run docker compose up -d
2. Open a terminal within the container with docker exec -ti <container> /bin/sh
3. Add the edge source: echo "http://dl-cdn.alpinelinux.org/alpine/edge/main" >> /etc/apk/repositories
4. Run apk update
5. Run apk add nginx=1.28.2-r0, if this issue occurs at a later point, you can use apk search nginx to find the latest version. Make sure to take the error into consideration when choosing a version. Here 1028002 in the error, means we need 1.28.2-r0.
6. Run apk add -U $(apk list -qI 'nginx-mod-*' | xargs -I {} echo {}=1.28.2-r0). This will also update all the modules to this version, otherwise you will still get a similar error. Again make sure to check the version at the end of the command and change when needed.
7. Run nginx -t. You should now get something like nginx: the configuration file /etc/nginx/nginx.conf syntax is ok. If not, there are more modules to update, or something else is the actual issue.
8. Exit the container with exit
9. Stop and start the container. Do not use down/up as it will remove what you just did. So docker compose stop <container> and then docker compose start <container>
10. Issue is fixed for now

[HeyItsJono]

@kennyboy55 this has partially helped update some packages, but I'm still getting module "/var/lib/nginx/modules/ndk_http_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/10_devel_kit.conf:1, any idea how I can figure out which module needs updating?

[kennyboy55]

Hmm, I would expect that package to have been updated by running the commands.

Can you try:

1. Inside the swag container (so using docker exec again) run: apk list -I 'nginx*'
2. You will get a list with output like this: nginx-mod-devel-kit-1.28.2-r0 x86_64 {nginx} (BSD-2-Clause) [installed]
3. Check that everything in that list is using 1.28.2-r0, if not you will have to update those packages.
4. To do so, for each package run apk add -U <package>=1.28.2-r0, where package name is everything before the version number. So looking at the step 2 output, here it would be nginx-mod-devel-kit

Hope that helps.

[Crash1602]

Same Issue here :-/

2026/02/06 10:33:10 [emerg] 1017#1017: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028002 instead of 1028000 in /etc/nginx/modules/30_http_lua.conf:1

[thespad]

I've triggered a new build of Swag which should pick up the latest nginx version and thus bring it into line with the lua mod version.

[kennyboy55]

I just pulled the latest version from 5 minutes ago and it started without issue, thanks!

[HeyItsJono]

Hmm, I would expect that package to have been updated by running the commands.

Can you try:

1. Inside the swag container (so using `docker exec` again) run: `apk list -I 'nginx*'`

2. You will get a list with output like this: `nginx-mod-devel-kit-1.28.2-r0 x86_64 {nginx} (BSD-2-Clause) [installed]`

3. Check that everything in that list is using `1.28.2-r0`, if not you will have to update those packages.

4. To do so, for each package run `apk add -U <package>=1.28.2-r0`, where package name is everything before the version number. So looking at the step 2 output, here it would be `nginx-mod-devel-kit`

Hope that helps.

Thank you, that fixed it!

[Gp2mv3]

Hello,
I've the same issue with version 1.28.3 now:

swag-proxy | 2026/03/26 17:05:27 [emerg] 969#969: module "/var/lib/nginx/modules/ngx_http_lua_module.so" version 1028003 instead of 1028002 in /etc/nginx/modules/30_http_lua.conf:1

Unfortunately, it seems that the module doesn't exist in version .2 anymore:

apk add -U nginx-mod-http-lua-1.28.2-r0
fetch http://dl-cdn.alpinelinux.org/alpine/v3.22/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.22/community/x86_64/APKINDEX.tar.gz
ERROR: unable to select packages:
  nginx-mod-http-lua-1.28.2-r0 (no such package):
    required by: world[nginx-mod-http-lua-1.28.2-r0]

Is there a solution ?

Thanks !

[thespad]

This will unfortunately continue to be a problem because of maintainers of lua-resty-core and nginx-mod-http-lua are not the same person and so there's always a window where they're not in sync. Nothing we can really do about it from our end.

[kennyboy55]

@Gp2mv3 the command is also incorrect, should be: apk add -U nginx-mod-http-lua=1.28.2-r0