Allow listening on privileged ports (below 1024) as non-root #1778

New Issue

MrUnknownDE · 2026-04-06T02:22:35+02:00

MrUnknownDE commented

2026-04-06 02:22:35 +02:00

Originally created by @jjlin on 1/25/2023

This is done by running setcap cap_net_bind_service=+ep on the executable in the build stage (doing it in the runtime stage creates an extra copy of the executable that bloats the image). This only works when using the BuildKit-based builder, since the COPY instruction doesn't copy capabilities on the legacy builder.

*Originally created by @jjlin on 1/25/2023* This is done by running `setcap cap_net_bind_service=+ep` on the executable in the build stage (doing it in the runtime stage creates an extra copy of the executable that bloats the image). This only works when using the BuildKit-based builder, since the `COPY` instruction doesn't copy capabilities on the legacy builder.

MrUnknownDE closed this issue

2026-04-06 02:22:35 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#1778