I recently learned that Crowdsec can monitor docker containers by labels making it a very dynamic approach that reduces a lot of maintenance of the acquisition files. Really love how quickly I can monitor another docker container simply and configure this on the container side alone.
Unfortunately Crowdsec doesn't auto-manage the necessary collections. So though it knows to inspect e.g. a postfix container, it can't unless the postfix collection has been manually installed (or already was). Could this be introduced? I don't expect crowdsec to automatically know which collection to install per label. This could be defined through yet another container label.