OpenCTI Restart Loop: The Admin Token Must Be a UUID

A fresh Docker Compose deploy that kept restarting, solved by one log line and a uuidgen.

2026-02-03#CyberDen

work: 2026 · Done · short · Threat Intelligence, OpenCTI, Docker

Symptom

On a fresh Docker Compose deployment of OpenCTI in CyberDen's CTI container host, the platform container restarted endlessly. The dependencies (Elasticsearch/OpenSearch, Redis, RabbitMQ, MinIO) were up.

OpenCTI container unhealthy — Every dependency healthy, and OpenCTI itself in a restart loop.

Finding it

docker compose ps
docker compose logs --tail=100 opencti

In the logs:

CONFIGURATION_ERROR: Token must be a valid UUID

Root cause

The .env still had the template's placeholder for OPENCTI_ADMIN_TOKEN, which the compose file maps to the platform's admin token. OpenCTI validates that value at startup and refuses to boot without a real UUIDv4.

Fix

uuidgen                       # generate a real UUIDv4
# put it in .env as OPENCTI_ADMIN_TOKEN=<uuid>
docker compose up -d --force-recreate opencti
docker compose logs -f opencti

Do the same for every other ChangeMe value in the template: connector IDs need UUIDs too.

Lesson

Template .env files are a checklist, not defaults. grep -i changeme .env before the first up.

Sources: SOC CTI Mini-Stack (30 Jan 2026), Containerization on T320 (20 Apr 2026)