Container cannot bind to port 80 running as non-root user on ECS Fargate

Question

I have an image that binds to port 80 as a **non-root** user. I can run it locally (macOS Monterey, Docker Desktop 4.7.1) absolutely fine.

When I try and run it as part of an ECS service on Fargate it fails as so:

**Failed to bind to 0.0.0.0/0.0.0.0:80**

**caused by SocketException: Permission denied**

Fargate means I have to run the task in network mode `awsvpc` - not sure if that's related?

Any views on what I'm doing wrong? The [best practices document](https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/bestpracticesguide.pdf) suggests that I should be running as non-root (p.83) and that under awsvpc it's reasonable to expose port 80 (diagram on p.23).

FWIW here's a mildly cut down version the JSON from my task definition:
```
{
    "taskDefinitionArn": "arn:aws:ecs:us-east-1::task-definition/mything:2",
    "containerDefinitions": [
        {
            "name": "mything",
            "image": "mything:latest",
            "cpu": 0,
            "memory": 1024,
            "portMappings": [
                {
                    "containerPort": 80,
                    "hostPort": 80,
                    "protocol": "tcp"
                }
            ],
            "essential": true,
            "environment": []
        }
    ],
    "family": "mything",
    "executionRoleArn": "arn:aws:iam:::role/ecsTaskExecutionRole",
    "networkMode": "awsvpc",
    "revision": 2,
    "volumes": [],
    "status": "ACTIVE",
    "requiresAttributes": [
        {
            "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
        },
        {
            "name": "ecs.capability.execution-role-awslogs"
        },
        {
            "name": "com.amazonaws.ecs.capability.ecr-auth"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
        },
        {
            "name": "ecs.capability.execution-role-ecr-pull"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
        },
        {
            "name": "ecs.capability.task-eni"
        }
    ],
    "placementConstraints": [],
    "compatibilities": [
        "EC2",
        "FARGATE"
    ],
    "runtimePlatform": {
        "operatingSystemFamily": "LINUX"
    },
    "requiresCompatibilities": [
        "FARGATE"
    ],
    "cpu": "256",
    "memory": "1024",
    "tags": []
}
```

ogaumond · Accepted Answer

I don't think this is specific to Fargate, rather than the actual container runtime.

It works when you run locally through Docker because Docker sets `net.ipv4.ip_unprivileged_port_start=0`, basically allowing you to bind any port as unprivileged. (more details: https://github.com/moby/moby/pull/41030).

If you want to run with a non-root user you will need to use a non-privileged port and modify your configuration to expose on that port.

JohnPreston · Answer

I have never had that issue and ran lots of containers with ports in the 1-1024 range (which usually requires root).
As far as running the app as root vs as another user, don't forget that, you might have to use the root user to start the process that will open the socket on your machine, but, run the application itself with another user. Typically that's what nginx would do, as you can see.

```
docker run -d --rm -it nginx -p 80:80
ps faux | grep nginx
root      207518  0.0  0.0   8856  6320 pts/0    Ss+  18:07   0:00  \_ nginx: master process nginx -g daemon off;
101       207568  0.0  0.0   9244  2508 pts/0    S+   18:07   0:00      \_ nginx: worker process
101       207569  0.0  0.0   9244  2508 pts/0    S+   18:07   0:00      \_ nginx: worker process
101       207570  0.0  0.0   9244  2508 pts/0    S+   18:07   0:00      \_ nginx: worker process
101       207571  0.0  0.0   9244  2508 pts/0    S+   18:07   0:00      \_ nginx: worker process
```
(101 is the nginx user btw).
I ain't much of a macOS user myself so maybe that is just more permissive than Linux with regards to ports to open. Don't forget that with containers you use the same kernel (and therefore its settings) but running your container elsewhere, with possibly hardened host, might not work anymore.

Container cannot bind to port 80 running as non-root user on ECS Fargate

Contenido relevante