hotfix(netbird-proxy): allow non-root :443 bind on the host network #409

Merged

k.renner merged 1 commits from netbird-proxy-port-sysctl into master 2026-07-26 05:44:07 +00:00

Conversation 1 Commits 1 Files Changed 1

+16

1 Commits

Author	SHA1	Message	Date
claude-botandClaude Fable 5	5fa8c03827	hotfix(netbird-proxy): allow non-root :443 bind on the host network ... The host-network switch (#406) broke both proxy members: the reverse-proxy runs as a non-root user, and on the host netns the default ip_unprivileged_port_start=1024 denies binding :443 — the container crash-loops with 'listen tcp :443: bind: permission denied'. In bridge mode Docker set the sysctl to 0 inside the container netns, which is why the published-port setup never hit this. Set net.ipv4.ip_unprivileged_port_start=443 persistently on the proxy hosts (governs v6 binds too, despite the name). The crash-looping container self-heals within its restart backoff once the sysctl lands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-26 07:41:10 +02:00