Oracle Linux 10 – podman container cannot bind privileged port under SELinux enforcement – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Containerized service fails to start when mapping low ports, affecting external availability.

Environment & Reproduction

Occurs with rootless or constrained container deployments under enforcing mode.

podman run -p 80:8080 myimage

Root Cause Analysis

SELinux and port labeling policies deny the requested bind operation.

Quick Triage

Inspect AVC denials, container runtime logs, and open ports.

getenforce
podman logs 
ausearch -m avc -ts recent | tail -n 40
firewall-cmd --list-ports
journalctl -u podman -n 60 --no-pager

Step-by-Step Diagnosis

Determine required SELinux port type and container policy context.

semanage port -l | grep http
podman inspect  | head -n 80
ausearch -m avc -ts recent | audit2why

Solution – Primary Fix

Assign correct SELinux port type and open corresponding firewalld service.

sudo semanage port -a -t http_port_t -p tcp 8080 || sudo semanage port -m -t http_port_t -p tcp 8080
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
sudo systemctl restart podman

Solution – Alternative Approaches

Run service on non-privileged host port and front with reverse proxy.

podman run -p 8080:8080 myimage
systemctl restart nginx

Verification & Acceptance Criteria

Container binds successfully and endpoint responds with no new AVC denials.

ss -tulpen | grep :80
curl -I http://localhost
ausearch -m avc -ts recent | tail -n 20

Rollback Plan

Remove custom SELinux port label and previous firewall rules if needed.

sudo semanage port -d -t http_port_t -p tcp 8080 || true
sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --reload

Prevention & Hardening

Document approved container ports and corresponding SELinux/firewall policy baseline.

Related Errors & Cross-Refs

Related to rootless networking limits and slirp4netns port-forwarding behavior.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Podman on RHEL, SELinux container policy, and firewalld service management docs.