Oracle Linux 10 – Podman container cannot bind privileged port under SELinux – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Container start fails when binding to low-numbered ports, causing app downtime and failed health checks.

Environment & Reproduction

Often occurs in rootless deployments and strict SELinux environments.

podman run --rm -p 80:8080 quay.io/podman/hello
getenforce
ss -lntp | grep ':80 '

Root Cause Analysis

SELinux port type mismatch or insufficient privileges in rootless networking prevents bind to privileged host ports.

Quick Triage

Check logs and AVC denials.

podman logs myapp || true
ausearch -m avc -ts recent
journalctl -u podman -n 50 --no-pager

Step-by-Step Diagnosis

Validate SELinux port labeling and container context.

semanage port -l | grep -E 'http_port_t|https_port_t'
ps -eZ | grep container_t
podman inspect myapp | grep -i selinux -n

Solution – Primary Fix

Map to non-privileged host port or label the port correctly for web traffic.

sudo semanage port -a -t http_port_t -p tcp 8080 || sudo semanage port -m -t http_port_t -p tcp 8080
podman run -d --name myapp -p 8080:8080 quay.io/podman/hello
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

Solution – Alternative Approaches

Use a reverse proxy on 80/443 and forward to container high ports.

sudo dnf install -y nginx
sudo systemctl enable --now nginx
sudo firewall-cmd --add-service=http --add-service=https --permanent

Verification & Acceptance Criteria

Container listens and endpoint is reachable without new AVC denials.

curl -I http://localhost:8080
ausearch -m avc -ts recent
podman ps

Rollback Plan

Revert custom SELinux port labels if they conflict with standards.

sudo semanage port -d -t http_port_t -p tcp 8080 || true
podman rm -f myapp

Prevention & Hardening

Publish explicit port/label policy for platform teams and validate in deployment pipelines.

semanage port -l | grep http_port_t
getenforce

Related Errors & Cross-Refs

Related to CNI plugin failures, rootless network namespace limits, and firewalld zone misses.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL container security documentation for Podman, SELinux, and network exposure patterns.