Can't bind port 80 without root privileges

[ogallart23]

Hi, first of all, thanks for rhis awsome project.

I'm trying to run HUG with hostNetwork: true and --ipv4-bind-address so it binds directly to a specific node IP on port 80 (different from another HAProxy instance listening on another IP on the same node).

However, I always get:

caps: detected port binding capabilities
min_unprivileged_port:1024
net_bind_service:false

I've tried multiple securityContext configurations (runAsUser, NET_BIND_SERVICE enabled/disabled, root/non-root, etc.), but HUG is never able to bind to port 80 as a non-root user.

As a comparison, I performed the same tests with HAProxy Kubernetes Ingress Controller and it is able to bind to privileged ports successfully in the same environment.

I mention this because, in version v1.0.4, my understanding was that low ports should be supported without running as root. Is there something I'm missing, or could there be an issue with the capability detection?

[oktalz]

hi @ogallart23

we did a64af0c
a couple of weeks ago, could you check with new version (most recent is v1.0.7 ) if you still have the problem ?

[ogallart23]

I tested this again with v1.0.7 and the issue is still present.

haproxy_wrapper has the expected capability:

/usr/local/sbin/haproxy_wrapper cap_net_bind_service=ep

and NET_BIND_SERVICE is present in the bounding set, so HUG detects:

net_bind_service:true

However, the HAProxy process starts with:

CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 0000000000000400
NoNewPrivs: 1

and fails to bind to ports 80/443 with Permission denied.

I also tested with allowPrivilegeEscalation: true, with the same result.

It looks like the capability set on haproxy_wrapper is not reaching the final HAProxy process.

I can give some logs if you need it.

Thanks in advance