Cannot listen to HTTP port: Permission denied when running container image using podman

[maeldroem]

Description

Following the instructions laid out in https://ferron.sh/docs/installation/docker using podman instead of docker results in the following error: Error while running a server: Cannot listen to HTTP port: Permission denied (os error 13).

This error happens regardless of the type of distro we choose for the container (tags 2, 2-alpine, 2-debian).

This can be fixed by setting default_http_port and default_https_port to values higher than 1024 (i.e. unprivileged ports).

[DorianNiemiecSVRJS]

I think Podman was running in rootless mode, and listening to the default HTTP port (80) needs root privileges.

I may consider adding a note about Podman to the documentation page, while also keeping the Docker-focused examples as they are...

[maeldroem]

I agree, and yes it was indeed running in rootless mode, however, this normally shouldn't matter, as Podman uses UID mapping so that from the host's perspective, we use an unprivileged user, but from inside the container, we still have the root user (therefore allowing privileged operations).

This is why I'm not sure of why this error is occuring, as the container has privileges on its own system (not the host's), so binding to privileged ports like 80 and 443 should normally work.

I suspect it has something to do with how ferron's image is built, as you can see on the 5th layer, it switches to user nobody, and I assume the port binding operations are done on the last layer (CMD instruction).

I'm not sure how Docker implements the USER instruction, but it could possibly be due to that. Perhaps on Docker the new user remains privileged in some way, while Podman assumes a new unprivileged user.

I would be very grateful if you could look a bit deeper into that issue, as from an outsider's perspective, it seems not possible that a new user (nobody) could bind to privileged ports.

Otherwise, is it possible to do an Nginx-like approach to that issue where the initialization is done by a privileged user (in order to bind to privileged ports), but then the ownership of the process switches to an unprivileged user (to guarantee security), perchance? 🤔

Thank you for your help :)

[DockMagnus]

One approach is: add another layer to the image setting port bind capabilities for ferron:

RUN apk update \
   && apk --no-cache add \
   libcap \
   libcap2 \
   && setcap 'cap_net_bind_service=ep' /usr/sbin/ferron \
   && apk del libcap libcap2

Remember NOT to use the no-new-privileges option (in compose.yaml or systemd Quadlet) to make setcap take effect.

But changing from a privileged user to a non-privileged one after port binding would be a more secure approach.

XOX Magnus.