[BUG] Need to restart every few hours

[nothing2obvi]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I'm sorry I don't have helpful logs (they appear totally normal, or at least unproblematic), but over the past few days, I lose connection. I've been using SWAG for years without issue, but every few hours now I have to restart the container to be able to connect to my services. SWAG is running on my VPS.

My build version is: Linuxserver.io version:- 5.4.0-ls449 Build-date:- 2026-04-04T04:56:31+00:00

I'm reverting to 5.4.0-ls448 to see if that changes anything.

Expected Behavior

SWAG lets me connect to my services.

Steps To Reproduce

1. Run SWAG and services
2. SWAG appears fine
3. Services unreachable
4. Restart SWAG
5. Services are reachable

Environment

- OS: 24.04.4 LTS (Noble Numbat)
- How docker service was installed: package manager

CPU architecture

x86-64

Docker creation

swag:
    image: lscr.io/linuxserver/swag:latest
    container_name: swag
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      - URL=mydomain.net
      - SUBDOMAINS=wildcard
      - VALIDATION=dns
      - DNSPLUGIN=cloudflare
      - DOCKER_MODS=ghcr.io/linuxserver/mods:swag-crowdsec
      - CROWDSEC_API_KEY=1234567890
      - CROWDSEC_LAPI_URL=http://crowdsec:8080
    volumes:
      - /root/Docker/swag/config:/config
    ports:
      - 443:443
      - 80:80
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    deploy:
      resources:
        reservations:
          cpus: 2.00
          memory: 2048M
    restart: unless-stopped

Container logs

[mod-init] Running Docker Modification Logic
[mod-init] Adding linuxserver/mods:swag-crowdsec to container
[mod-init] linuxserver/mods:swag-crowdsec at sha256:f796ea3ddc3345cb706a1e0239cacb475f03cf8d8719cbe106efdc1c6be5ec4f has been previously applied skipping
[migrations] started
[migrations] 01-nginx-site-confs-default: skipped
[migrations] 02-swag-old-certbot-paths: skipped
[migrations] done
usermod: no changes
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support the app dev(s) visit:
Certbot: https://supporters.eff.org/donate/support-work-on-certbot

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────
Linuxserver.io version: 5.4.0-ls449
Build-date: 2026-04-04T04:56:31+00:00
───────────────────────────────────────
    
using keys found in /config/keys
**** The following active confs have different version dates than the samples that are shipped. ****
**** This may be due to user customization or an update to the samples. ****
**** You should compare the following files to the samples in the same folder and update them. ****
**** Use the link at the top of the file to view the changelog. ****
┌────────────┬────────────┬────────────────────────────────────────────────────────────────────────┐
│  old date  │  new date  │ path                                                                   │
├────────────┼────────────┼────────────────────────────────────────────────────────────────────────┤
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/shlink.subdomain.conf                        │
│ 2024-07-16 │ 2025-07-18 │ /config/nginx/proxy-confs/filebrowser.subdomain.conf                   │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/portainer.subdomain.conf                     │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/glances.subdomain.conf                       │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/ntfy.subdomain.conf                          │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/pingvin-share.subdomain.conf                 │
│ 2024-02-23 │ 2025-07-18 │ /config/nginx/proxy-confs/stirling-pdf.subdomain.conf                  │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/chevereto.subdomain.conf                     │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/lubelogger.subdomain.conf                    │
│ 2023-06-24 │ 2025-07-18 │ /config/nginx/proxy-confs/nextcloud.subdomain.conf                     │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/homepage.subdomain.conf                      │
│ 2024-07-16 │ 2025-02-16 │ /config/nginx/proxy-confs/seerr.subdomain.conf                         │
│            │ 2025-07-18 │ /config/nginx/proxy-confs/watcharr.subdomain.conf                      │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/kavita.subdomain.conf                        │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/radarr.subdomain.conf                        │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/dozzle.subdomain.conf                        │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/sonarr.subdomain.conf                        │
│ 2024-07-16 │ 2025-07-18 │ /config/nginx/proxy-confs/syncthing.subdomain.conf                     │
│ 2024-03-28 │ 2025-07-18 │ /config/nginx/proxy-confs/immich.subdomain.conf                        │
│ 2024-07-16 │ 2025-07-18 │ /config/nginx/proxy-confs/duplicati.subdomain.conf                     │
│ 2025-07-18 │ 2025-08-28 │ /config/nginx/proxy-confs/qui.subdomain.conf                           │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/audiobookshelf.subdomain.conf                │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/bookstack.subdomain.conf                     │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/navidrome.subdomain.conf                     │
│ 2024-07-16 │ 2025-07-18 │ /config/nginx/proxy-confs/homebox.subdomain.conf                       │
│ 2023-05-31 │ 2025-07-18 │ /config/nginx/proxy-confs/kimai.subdomain.conf                         │
│ 2025-07-18 │ 2026-03-07 │ /config/nginx/site-confs/default.conf                                  │
│ 2024-03-16 │ 2025-03-25 │ /config/nginx/authelia-server.conf                                     │
│ 2024-03-14 │ 2025-03-25 │ /config/nginx/authelia-location.conf                                   │
└────────────┴────────────┴────────────────────────────────────────────────────────────────────────┘
Variables set:
PUID=1000
PGID=1000
TZ=America/Chicago
URL=mydomain.net
SUBDOMAINS=wildcard
EXTRA_DOMAINS=
ONLY_SUBDOMAINS=false
VALIDATION=dns
CERTPROVIDER=
DNSPLUGIN=cloudflare
EMAIL=
STAGING=

Using Let's Encrypt as the cert provider
SUBDOMAINS entered, processing
Wildcard cert for thehouses.xyz will be requested
No e-mail address entered or address invalid
dns validation via cloudflare plugin is selected
Certificate exists; parameters unchanged; starting nginx
The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am).
[custom-init] No custom files found, skipping...
[ls.io-init] done.
2026/04/06 16:09:45 [warn] 1124#1124: conflicting server name "pdf.*" on 0.0.0.0:443, ignored
2026/04/06 16:09:45 [warn] 1124#1124: conflicting server name "pdf.*" on [::]:443, ignored
nginx: [error] [lua] crowdsec.lua:119: init(): error loading captcha plugin: no recaptcha site key provided, can't use recaptcha
nginx: [alert] [lua] crowdsec_nginx.conf:4):8: [Crowdsec] Initialisation done
Server ready

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thelamer]

Docker logs are not oneshot, they are maintained for the life of a specific named container or by ID. You should be able to pull the logs before you restart at the very least. If it is completely non responsive it should be obvious, also run top quickly and see if there is significant load on the system and if so from what. Clean startup logs are not very useful.

You said it happens every few hours this should be pretty easy to source no?

[nothing2obvi]

Thanks for your reply. I only shared that set of logs because all of them looked exactly like that. No errors of any kind. top reveals the VPS is healthy. I've reverted to 5.4.0-ls448 for now and so far no issues.

[nothing2obvi]

Went back to latest and seems to be fine now. Unsure what was going on. I'd like to keep this open in case it happens again, but if you feel you should close it, please do so. Thanks.