4 ms·
If you want something as non-root to bind below 1024, there's a sysctl for it.[1] Docker bypasses this essentially because it uses root privs to set up the por
by BeefWellington 4y ago
If you want something as non-root to bind below 1024, there's a sysctl for it.[1]
Docker bypasses this essentially because it uses root privs to set up the port forwarding rules.
[1]: https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html https://www.kernel.org/doc/html/latest/networking/ip-sysctl.... -> ip_unprivileged_port_start
- sph 4y agoIt's not enough in some cases, in a multi container pod (with `podman play kube`) I still got permission issues binding to privileged ports (which were permitted by the sysctl). There was some github issue about it. In my experience, if you need to bind to < 1024 ports, just run the container as root. Also if you want finer-grained control of host-side permissions of your mounts (i.e. map host uid 1000 to container uid 99). Otherwise rootless is fine.
- BeefWellington 4y agoNote that that sysctl indicates it's namespace-specific, so it's possible it needs to be set for the application's namespace (maybe as well) via `--sysctl` on the podman command line. I did a quick test and it works ok for me to bind to low numbered ports just passing that param to podman run.